HSIC Bottleneck for Cross-Generator and Domain-Incremental Synthetic Image Detection
Authors: Chin-Chia Yang
Yung-Yu Chuang
Hwann-Tzong Chen
Tyng-Luh Liu
Venue: ICLR 2026 Poster (2026)
Keywords: HSIC Bottleneck;Cross-Generator Synthetic Image Detection;Domain-Incremental Learning
Primary area: applications to computer vision, audio, language, and other modalities
TL;DR: We applied the HSIC bottleneck for cross-generator synthetic image detection and designed an HSIC-Guided Replay for domain-incremental synthetic image detection.

Abstract: Synthetic image generators evolve rapidly, challenging detectors to generalize across current methods and adapt to new ones. We study domain-incremental synthetic image detection with a two-phase evaluation. Phase I trains on either diffusion- or GAN-based data and tests on the combined group to quantify bidirectional cross-generator transfer. Phase II sequentially introduces renders from 3D Gaussian Splatting (3DGS) head avatar pipelines, requiring adaptation while preserving earlier performance. We observe that CLIP-based detectors inherit text-image alignment semantics that are irrelevant to authenticity and hinder generalization. We introduce a Hilbert-Schmidt Independence Criterion (HSIC) bottleneck loss on intermediate CLIP ViT features, encouraging representations predictive of real versus synthetic while independent of generator identity and caption alignment. For domain-incremental learning, we propose HSIC-Guided Replay (HGR), which selects per-class exemplars via a hybrid score combining HSIC relevance with k-center coverage, yielding compact memories that mitigate forgetting. Empirically, the HSIC bottleneck improves transfer between diffusion and GAN families, and HGR sustains prior accuracy while adapting to 3DGS renders. These results underscore the value of information-theoretic feature shaping and principled replay for resilient detection under shifting generative regimes.

Published as a conference paper at ICLR 2026
HSIC BOTTLENECK FOR CROSS-GENERATOR AND DOMAIN-INCREMENTAL SYNTHETIC IMAGE DETEC- TION
Chin-Chia Yang'-4, Yung-Yu Chuang1,2, Hwann-Tzong Chen & Tyng-Luh Liu
1 DDeparmment of Computer Science, National Taiwan University, Taiwan
2 Al Center of Research Excellence (AI-CoRE), National Taiwan University, Taiwan 3 DDeparmeent of Computer Science, National Tsing Hua University, Taiwan Institute of Information Science, Academia Sinica, Taiwan {f1094200 2093,, cyy)e Jcsiie ntu. edu. tw ht atchen@es es. nthu. edu. tw, liutyngeiis...... sinica. edu. tw
ABSTRACT
Synthetic image generators evolve rapidly, challenging detectors to generalize across current methods and adapt to new ones. We study domain-incrementae synthetic image detection with a two-phase evaluation. Phase trains on ei- ther diffusion- GAN-based data and tests the combined group quantify bidirectional cross-generator transfer. Phase sequentially introduces renders from 3D Gaussian Splatting (3DGS) head avatar pipelines, requiring adaptation while preserving carlier performance. We observe that CLIP-based detectors in- herit text-image alignment semantics that are irrelevant to authenticity and hinder generalization. We introduce a Hilbert-Schhe Hilbert-Schhidt Independence Criterion (HSIC) bottleneck loss on intermediate CLIP ViT features, encouraging representations predictive of real versus synthetic while independent of generator identity and caption alignment. For domain-incremmenal learning, we propose HSIC-Guided Replay (HGR), which selects per-class exemplars via hybrid score combining HSIC relevance with k-center coverage, yielding compact memories that mitigate forgetting. Empirically, the HSIC bottleneck improves transfer between diffusion and GAN families, and HGR sustains prior accuracy while adapting to 3DGS ren- ders. These results underscore the value of anformation-theoree feature shaping and principled replay for resilient detection under shifting generative regimes.
INTRODUCTION
The rapid progress of generative models has led to increasingly realistic synthetic images, raising urgent concerns about the spread of misleading digital content. The detection problem inherently open-worid: new diffusion architectures. GAN variants, and 3D Gaussian Splatting (3DGS) ren- dering pipelines will continue to emerge, remaining unseen during training. Among these, 3DGS has enabled photorealistic, real-time head avatars, expanding the scope of rendered imagery beyond traditional 2D synthesis. As illustrated in Figure I synthetic images produced by GANs, Deep- fake, and 3DGS exhibit distinct artifacts and statistical patterns, motivating detectors that generalize beyond any single generative family.
A practical detector therefore requires two key capabilities: (i) robust generalization across diverse generation paradigms and (ii) continual adaptability to incorporate new synthetic sources without catastrophic forgetting. Existing systems that rely on the vision backbone of CLIP show promising cross-generes goos--generator transfer between diffusion and GAN data. However, CLIP embeddings are primarily optimized for text-image alignment, embedding caption semantics that are irrelevant to authenticity and potentially detrimental when the task is purely image- based. As shown in Figure 2 the raw CLIP features cluster together according to object class rather than the real-synthetic boundary.
We tackle these challenges with two complementary components integrated into a single pipeline. First, introduce Hlilhert-Schmie Independence Criterion (HSIC) bottleneck on features

---

Published as a conference paper at ICLR 2026
StarGAN
StyleGAN
Deepfake
Multi-view 3DGS
Single-view 3DGS
Generative 3DGS
Real
P
or
Synthetic
Figure I: Diversity of synthetic images across paradigms. Columns show representative sources of synthetic faces: StarGAN, StyleGAN, Deepfake (face swap), multi-view 3D Gaussian Splatting (3DGS) head avatar, single-view 3DGS head avatar, and generative 3DGS head avatar. Top row: real images. Bottom row: corresponding synthetic examples. The breadth of GAN-based synthesis and rendered 3DGS avatars creates substantial distribution shifts, underscoring the need for detectors that both generalize to unseen sources and continually adapt as new synthetic sources emerge.
tracted from the intermediate layers of CLIP ViT. Specifically, we aggregate multi-layer repre- sentations, project them to compact latent space, and optimize an HSIC objective that minimizes dependence on the input while maximizing dependence on the label. This regularization suppresses nuisance factors (including text-alignment signals) and produces senerator-invarian yet discrimina- tive representations, strengthening mutual generalization between diffusion and GAN models.
Second, for continual learning rendered domains, we propose HSIC-Guided Replay (HGR). Dur- ing adaptation, HGR constructs a compact exemplar memory per class by ranking candidates with a weighted score that combines HSIC relevance (information centrality) and k-center coverage (spa- tial spread). These exemplars are replayed alongside new data to mitigate forgetting and stabilize performance across evolving domains. To support this setting. we curate three 3DGS head avatar datasets covering multi-view reconstruction, single-view reconstruction, and generative pipeline. Each dataset provides paired real and synthetic frames with identity-disjoint splits and standardized preprocessing. The synthetic images are highly challenging and cannot be reliably detected by exist- ing synthetic image detectors. Our evaluation first trains detectors exclusively on diffusion or GAN images to measure cross- gross-generator transfer, and then sequentially adapts them to the curated 3DGS domains under all adaptation orderings, while continuously monitoring prior-domain accuracy.
In summary, our contributions are threefold.
HSIC Bottleneck for Generalized Synthetic Image Detection. We impose an HSIC bottleneck on intermediate CL.IP features to suppress text-alignment nuisances and amplify image-label dependence, substantially improving cross-generade generalization.
HSIC-Guided Replay (HGR) for Continual Adaptation. We introduce an HSIC-driven exemplar selection and weighting scheme that delivers compact yet effective replay, en- abling adaptation to 3DGS content while preserving prior accuracy.
3DGS Synthetic Image Benchmark. We curate 3DGS rendered image suite spanning multi-view reconstruction, single-view reconstruction, and generative 3DGS pipeline, offering benchmark to advance research synthetie image detection.
To the best of our knowledge, we are the first to introduce a photorealistic 3DGS Synthetic Image Benchmark, together with continual learning solution tailored this setting, providing the com- munity with much-needed, realistic testbed for studying robustness and generalization of synthetic image detectors under evolving 3D generation pipelines.
2

---

Published as a conference paper at ICLR 2026
Synthetic
Litssses
Irid
Braut
chair
Chi
pertos
PSNE-1
I-NE-1
Figure 2: HSIC bottleneck transforms CLIP semantic clusters into real/synthetic separability. I-SNE visualization features before (z, left) and after (z, right) applying the HSIC bottleneck. Points are colored by semantic class, with markers denoting Real (+) and Synthetic (x). Pretrained CLIP features r mainly cluster by object category, intermixing real and synthetic samples within each class. By contrast, the HSIC bottleneck suppresses nuisance semanties and reshapes the rep- resentation to align with the labels, causing real images to cluster together and synthetic images to cluster together across categories, thereby producing clearer decision boundary for detection.
2 RELATED WORK
2.1 GENERALIZED SYNTHETIC IMAGE DETECTION AND 3DGS HEAD AVATARS
Wang et al. (2020) first explicitly posed the problem of generalization to unseen generators in syn- thetic image detection, showing that with careful pre/post-processngg and augmentation, classifier trained on one GAN (e.g., ProGAN) can transfer to other generators, indicating shared synthesis artifacts. Following Wang et al.) (2020), many works have further explored techniques that identify forensic cues for detecting synthetic images (Qian et al. 2020 Chai et al., 2020). I.Grad (Tan et al.) 2023) moved toward generator-age agnnosic cues by operating in gradient space, yielding strong cross- generator generalization for GAN fakes. NPR (Tan et al. (2244) rethinks source-invariant artifacts by analyzing up-sampling operations common to GANs and diffusion pipelines, proposing neigh- boring pixel relationships as simple, local pixel-dependency descriptor that generalizes across wide range of generators.
Recent work has begun to specifically target diffusion diffusion-generatee generated image detection. DIRE (Wang ctt al. (023a) leverages diffusion inversion-basedd reconstruction to expose discrepancies between real and synthetic images, using reconstruction error patterns as robust cues for detecting diffusion- based fakes. Building on this idea, DRCT (Chen et al. 2024) further exploits reconstruction signals through contrastive objective: real and reconstructed pairs are pulled together, while diffusion- generated and reconstructed pairs are pushed apart. This reconstruction-awee contrastive training encourages the detector capture generator-agnostic artifacts from the diffusion process, leading to strong cross-model and tross-dataset generalization.
A complementary line of work leverages large vision- language backbones (Radford et 2021 Oquab et al.) 2024; Touvron et al.] (2023). specifically CLIP (Radford et al.] (2021). for generalized
synthetic image detection (Ojha et 2023;
Koutlis Papadopoulos/ 22024 Zhang et al., 2025
Yang et al.] 2025). UniFD (Ojha et al.) 2023) demonstrated that operating directly in frozen CLIP
feature space-using a nearest-neighhor or a linear probe-provide markedly improved transfer to unseen families, including mutual transfer between diffusion and GAN models. Building on this idea, RINE (Koutlis Papadopoulos 2024) extracts intermediate encoder-block representations from CLIP rather than only the final layer, capturing richer structural and semantic cues that generalization. Most recently. VIB-Net (Zhang et al.) (025) couples pre- trained CLIP backbone with variational information bottleneck suppress iask-irreeevant factors
hance

---

Published as a conference paper at ICLR 2026
while retaining discriminative evidence, pushing universal detection performance across generator families.
Beyond diffusion and GAN imagery, 3D Gaussian Splatting (3DGS) enables photorealistic, real- time rendering with explicit point-based primitives and has rapidly become a foundation for head avatar synthesis, introducing rendered-fake sources that differ from conventional image synthe- sis. We highlight three representative families that define our rendered-fake domains: (i) Multi- view 3DGS head avatar-Gaussian Head Avatar (Xu et al., 2024) proposes dynamic, control- lable 3D Gaussians for ultra high-fidelity head modeling, pairing a learned deformation field with an explicit 3DGS representation and multi-view supervision; (ii) Single-view 3DGS head avatar- Sain--SSaatnnnnttttte (Shao et al.) (024) embeds Gaussians on a deformable mesh to disentan- gle motion and appearance, supporting real-time rendering from monocular training signals; and (iii) Generative 3DGS head avatar GAGAvatar (Chu & Harada (024) predicts 3DGS parameters from single image for one-shot, animatable, and generalizable avatars. These three categories define the rendered-fake domains in our continual learning protocol, complementing diffusion and GAN synthesis, and support systematic vross-generator evaluation. Despite the progress of general- ized detection diffusion and GAN, detectors that transfer well across these paradigms frequently falter on 3DGS rendered fakes, motivating methods that couple stronger generalization with princi- pled continual adaptation.
2.2 CONTINUAL LEARNING
We investigate continual learning in the domain-inccrmmnntal regime: the label space remains fixed, while the input distribution shifts across domains-first among diffusion or GAN genera- tors, and later to 3DGS categories. Continual methods are commonly grouped into three fam- ilies: regularization-base proaches (Kirkpatrick et al. 2017: Zenke et al., 2017: Li & Hoiem, 2018, Aljundi et al., 2018) constrain parameter updates to protect knowledge from earlier domains. Architecture-
architecture-based, and rehearsal-based Regularization based ap-
meth- ods (Rusu et al., 2016; [Mallya & Lazebnik, 2018; Yan et al.) [02T]] WWng et al.] 2025) expand capacity or allocate disjoint subnetworks to reduce interference, Rehearsal-based methods maintain compact replay memory and interleave past exemplars with current data. Class-mean herding (iCaRL) Rebuff et al., 2017) selects exemplars near class centroids to ensure representativeness. class-balanced reservoir sampling (CBRS) (Chrysakis & Pourkamali -nnrraa (2020) adapts clas- sical reservoir sampling to preserve label balance in nonstationary streams. Coverage-oriented se- lection via the greedy k-center (farthest-fistt) heuristic (Gonzalez) 1985; Sener & Savarese, 2018) spreads exemplars across the feature space to improve diversity and reduce redundancy. DualH- SIC (Wang et al. (023b) leverages the Hilbert-Schmidt Independence Criterion (HSIC) to explic- itly model inter-task relationships. It introduces two complementary losses: HSIC-Bottleneck for Rehearsal (HBR), which penalizes dependence between buffered inputs and intermediate features while preserving sabel-featur dependence to suppress task- nuisance information, and HSIC Aligmment (HA), which maximizes dependence between current-task and buffered features to pro- mote task-invariant knowledge sharing. Since replay is arguably the most widely adopted and prac- tically deployed mechanism in continual learning, we focus on what we view as its key factor: the sampling strategy. As the first work to study continual learning setup for synthetic image detec- tion, we build on this rehearsal based line of work in the domain-incremmntal setting and introduce HSIC-Guided Replay, a replay-based sampling strategy tailored to synthetic image detection that scores and selects exemplars to preserve coverage of prior domains while adapting to new ones.
2.3 CILBERT-SCHMID INDEPENDENCE CRITERION (HSIC)
HSIC (Gretton et al. 2005) is kernel-based measure of statistical dependence between random variables, defined via reproducing kernel Hilbert spaces (RKHSs). Let a E A and b E B be random variables associated with RKHSs (F, k) and (G, E). induced by feature maps Φ
F
and 30 B + G. respectively. Let the corresponding mean embeddings be μa B[ø(a)] and pb [b)]. The cross-covariance operator Cab G - FF is defined as
Cab (o(a) - Ma) @ (bb(b) - pb)].
(1)
The population HSIC is the squared Hilbert-Schmidt norm of this operator:
HSIC F, G, ||Cab] |
(2)
4

---

Published as a conference paper at ICLR 2026
Kernel expectation form (population). Let (a', bb) be an independent copy of (a, b). Expanding equation 2 yields the following equivalent expression in terms kernels and f:
HSIC(a, b) =Eaa'bbi [k(a, a') a', + Eax [k(a, a') Ebb b']
(3)
2 Bab
Eg (a, a') Es (b, b')
which is zero if and only if and b are independent under suitable conditions, e.g., when character- istic kernels are used.
Empirical estimator. Given n ii.d. samples {(a; )= from Pab. define the Gram matrices K, L E Roxa by Kiz k(a;; (2) and Lij E(b,, by). Let 1 IK" denote the all-ones vector, I, E R the identity matrix, and the centering matrix H I 111", which is symmetric and idempotent. A commonly used (biased) V-statistic estimator is
1
HSIC b) = (n - 1)2 to (H(LHH)
(n 1)a (HKHHLH) = (n 1)2 to LLL,
where tr(-) denotes the standard matrix trace operator. This estimator provides an efficient empirical estimate without requiring density models. In practice, Gaussian RBF kernels are often adopted for k and f, and the bandwidth can be set by the median heuristic. The centered versions K" -KK H and L = HLH correspond centering the associated feature maps, so that equation matches the population definition equation through equation
3 METHOD
Our detector builds on CLIP ViT features, which, like most pretrained extractors, are not tailored to synthetic image detection and often entangle authenticity with generator identity and text-image semantics. To mitigate this, we introduce an HSIC bottleneck that refines features for real-versus- synthetic discrimination while suppressing spurious dependencies. For ing, we further propose HSIC-Guided Replay (HGR), which selects compact exemplars to balance adaptation to generators with retention of prior knowledge.
learn-
3.1 HSIC BOTTLENECK
Let the model be hg = go, o fo,, where fo, is an encoder and go, is a classifier. DualHSIC (Wang al. 2023b), the encoder is ResNet with L intermediate layers. Given input representation x, label y, and layer-j feature Zj (j = 1,...,AA L), the layer-wise HSIC objective is
(H)( > Σ 1=1
HSIC(2, 2,) - X Σ HSIC(y. Zy),
(5)
where 2 encourages compression of input information, while xy encourages dependence on the label e (0, 1}. indicating whether the sample is synthetic (1) authentic (0).
Unlike DualHSIC, which applics HSIC at all intermediate layers, we use CLIP ViT as the feature ex- tractor. For each image, we form CLIP feature representation z by concatenating features from its 24 intermediate layers and the final layer, and then compress it into 2 = So, (æ). Adapting equation to this setting gives
BistCcBottteneckfe
^e HSTC(a,,) 2) Xy HSIC(y, 2).
3.2 TRAINING ORJECTIVE
For each sample i, let be its CLIP feature representation and z = fey (xx) be the compressed feature. The classifier 9a, outputs logit u; 9e, (zi), and the corresponding probability is p: = (u:), where (-) is the sigmoid. For binary labels yi {0, 1}. we use binary cross-entropy:
LACF LNCR(0y.0g)
= n Σ
ys log + (1 - y:) - -p:)) pb)]
The final objective is
Liotal (0,. 0g)
Lusic Bottleneete (Og) Lncc(O,,0, 0g).
(8)
5

---

Published as a conference paper at ICLR 2026
3.3 HSIC-GUIDED REPLAY (HGR)
We combine an HSIC-inspired relevance score with a k-center coverage term to select exemplars for the rehearsal buffer. A nonnegative weight A 0 controls the strength of the k-center regularizer: =k== yields pure relevance-based selection, while larger values emphasize coverage. Selection performed per class candidate set of CLIP feature representations with index set I. At step t, let St-1 C I be the St-1-
{0, 1}. but we omit below for simplicity. Let X' {ai be the
selected indices (with So = 2), and define the active set A,
For each I; X, compute 2, for (z:). Form the Gaussian RBF Gram matrix K on faheez and let K be its centered version in equation The HSIC-inspired relevance score for index i I is
K 1
(9)
To promote coverage and reduce redundancy, we add a k-center term in feature space, following the coreset view of Sener & Savarese (2018). Define, for i A,,
| - min || 2,11 JES.-1
t=1,
((t))
with
[ Σ 2j+
122,
JEI
so that larger (1) favors points farther from the already selected set.
Selection rule.
HGR selects exemplars by minimizing the -ec-ragulrrized score (t) (1 Nr(s)) Akc (I-N()(t))) i Ac.
(10)
Here, .V(-) denotes normalization operation. We choose 2 arg mi st( and update S; = S U {ip until |S&]] me, where me is the number of exemplars allocated to class c. Repeating this for с {0,1] and taking the union across classes and domains yields the replay buffer. Intuitively, HGR favors items that are both highly ranked by the relevance score (large r;)
and provide coverage (large (t)).
4 EXPERIMENTS
4.1 EXPERIMENTAL SETUP
Task and protocol. We study cross-generator synthetic-image detection in two phases under the following protocol. (1) Cross-generutor generalization: train detector on one paradigm (diffusion or GAN) and evaluate on the union of diffusion and GAN targets to measure generalization abil- ity. (2) Domain-incrementur learning: starting from the model in phase (1), continue training as rendered-fakes from 3DGS head avatar pipelines are introduced sequentially (GHA, SA, GAGA- vatar). During this phase, we always monitor performance previously seen diffusion and GAN test sets to quantify retention alongside adaptation.
Baselines. We benchmark against classical and recent detectors for cross-generator generaliza- tion, including CNNSpot (Wang et al.] (020). L.rrad (Tan et al.) (203)), UniFl) (Ojha et al. 2023) NPR (Tan al. 2024). RINE (Koutiis & Papadopoulos 2024). and VIB-Net (Zhang et al. 2025 For intemmmnaanem learning, we compare HISIC-Guided Replay with iCaRL (Rebuffi et al. 2017) and CBRS (Chrysakis Pourkamali-
2020). All rehearsal- methods share the same per-class memory budget, and all other training hyperparameters identical across methods.
Datasets. For gass-genrrttor generalization, we use GenImage, which contains diffusion- generated images from Stable Diffusion 1.5 (Rombach et al.) 2022). ADM (Dhariwal &
Nichol 2021). GLIDE (Nichol et al.) 2022). Midjourney (Midjourney 2022). Wukong (Wukong)
2022). and VQDM (Gu et al. (022). The GAN sources are taken from the collection of Wang et al.
(2020) including ProGAN (Karras et al.] 2018), CycleGAN (Zhu et al. 2017). BigGAN (Brock
ct al. 2019). StyleGAN (Karras et al. 2019). StarGAN (Choi et al. 2018), GauGAN (Park et al.
2019 as well as Deepfake (Rossler al. 2019) and SAN (Dai et al.
2019

---

Published as a conference paper at ICLR 2026
Table 1: Cross-generator generalization with diffusion-trained detectors (ACC/AP). Each cell
reports ACC/AP (%). Within each dataset row, the highest, second highest, and third highest ACC are shaded red, orange, and yellow, respectively. The SDV1.4 row label cell is shaded green to indicate the diffusion training source.
Method (ACC/AP %)
Dataset
CNNSpot
LGrad
UniFD
NPR
RINE
VIB-Net
Ours
intermediate
S
99.48/99.99 98
99. 00.12/99.94 94
83,55/96.04
100,0V100:00
96. 16.10/000.0
99,55/100.00
99. 00.33/99.9 98
99.92/100.00
SDVL5
99.35/99.83
99.05/99.92 92
84.80/9..2 26
99.50/99.97
95. 95.90999999 90
99.20/99.97
99.24/99.95
99.81/100.00
ADM
50,10/51.10
53.00588552
53.35166.34
73.00/94.7
53.70/86.88
73.85/95.49
85.82/97.69
91. 91.10999.6
GLDDE
50.90/58.80 80
64. 00
75.30993.75
89,7095 80
56.7095570 70
74.25/97.13
94, 34.99999.26
97.07/99 85
Midjourncy
56.4267.993
76.34/91.06 0.66
71 11.60/92.08
$2.30/9.50
39.20997.00
88.05/97.81
83. 12/97.3335
86/86/99..
Wulkong
97.90999 80
97.53/99.17 72
73,55/90.98
100.00/1000000
01.00099000 80
98.25/99.95
98. 62/99 92
99 86/166000000 00
VQDM
50.04/49.92
50.93/56.34
55. 15.15/
68.30/86.30 30
57.40/96.50
89,35/97.00
93.69/99.25
99.42/99.99 999
ProAAN
50.27/53.15
61.61/83.599
58.65/51.77
60. 30.3309333
68. 08.90/81.44
39.20/96.50
97.54/99.68 64
19/.99999999 99
CycleGAN
49 29.81/50.23
60.74990.2
59.30/63.44 4.24
67. (7.20994.90 90
66.50/96.80 80
60/6609988..
97. 92/92999.0 86
02.66699990
BigGAN
50. 10040099777 79
48, 82/47.51111
61 45775.81
59 20/2.00
52, 12.40//4400 00
91. 21,20997 17
90. 28/22/9888 01
91. 15/7//99.55 74
StyleGAN
50.98/55.96
61,433/82.74
56.80/54.12
10/83114
94,42/9
StaGAN
49.77/47.07
50.17/99.11
65/4449
73.20/97.30 700
58 15..0999.80 80
80, 80.70/97.61
96. 06.05599.52
100.90/100.00
GaaGAN
50.38/56.08
49. 29.70X49.25
55.30/65.99 99
$2.00666.00
51 80/88.0800 90
87.15/96.99
37.38/94.51
90.02/9.66 7.66
Deepfake
51.98/54.86
50. 17/66.444
58,40770.24 24
740800
72.00V8
66. 35/76777
15/93/83
SAN
50.22/54.03
56-49165.09
09
72.00/83.34
89, 00.66995.90 90
62, 01.33088880 70
81 $1..0/93.27
90.64/96.13
88.58/95 S1
Avg
60.51/63,24
65.29/78.24
65.37/75.31
76.50/89.98
64. 14.59/91.75
85.8 85.83/95.53
91. 11.69/97110
93.86/98.89
For
learning, we curate a three-part 3DGS benchmark: (i) Gaussian Head
Avatar (Xu et al., (024) (GHA) trained on NeRSemble (Kirschstein et al.] 2023) with identity-
disjoint, balanced splits (train: 45,772 real 45,772 synthetie; val: 9,480 9,440; test: 9,782 /
9.782); (ii) SplattingAvatar (Shao et al. 2024) (SA) trained on subjects from NeRFace (Gafni al.,
2021I. NHA (Grassal et al. 2022). and IM Avatar (Zheng et al. 2022) (train: 20,322 real / 20,094
synthetic; val: 4,007 4,036; test: 5.631 1 5,622)) and (iii) GAGAvatar (Chu & Harada 2024). one-
shot generative 3DGS avatar using FFHQ (Karras et al. 2019) inputs with pose-driven reenactment (train: 55,963 real 55,963 synthetie; val: 6.995 6,995; test: 6,996 / 6,996). In this paper, we fo- cus on the 3-domain incremental setting, as evaluating longer domain sequences (e.g., 5+ domains) under multiple orders would require a factorial number of runs and be computationally prohibitive. We prioritize 3DGS-renderee images over NeRF-rendered ones because, in our experience, 3DGS typically produces more photorealistic results.
4.2 CROSS-GENERATOR GENERALIZATION
We study out-of-source transfer by training detectors on a single family (diffusion or GAN) and evaluating across the union of all targets. This setting measures whether detector trained on one paradigm can generalize to others without exposure to its data.
Training on diffusion. Table cross- cross-generator generalization with diffusion-only training. Specifically, the detectors are trained on the SDV1 1.4 dataset. Using intermediate ViT features with an HSIC bottleneck yields the strongest overall mean, outperforming both strong baselines and our non-intermediate variant. Improvements are especially robust on GAN targets and remain consistent across several diffusion datasets, while AP near-saturated for most rows, indicating stable ranking quality. Although the non-intermediate variant occasionally tops individual entries (e.g.. StyleGAN, SAN), the intermediate configuration overall more consistent and generator- -nvvaiaan,,,,iinn,, preserving performance across diverse generators and manipulations.
Training on GAN. Table 2 summarizes cross- goos-geneeattor generalization under GAN-only training. Specifically, the detectors are trained on the ProGAN dataset. Using intermediate ViT features with an HSIC bottleneck achieves the best overall mean, outperforming strong baselines while markedly improving transfer to diffusion models. The intermediate configuration secures the best ACC on most diffusion targets and on a subset of GANs (e.g., ProGAN, StarGAN), while remaining com- petitive elsewhere. AP is naturstt across large portions of the table, indicating that suppressing nuisance variation at intermediate layers yields a representation that generalizes across generation paradigms without sacrificing ranking quality the source domain.
7

---

Published as a conference paper at ICLR 2026
Table 2: Cross-generator generalization with GAN-trained detectors (ACC/AP). Each cell re- ports ACC/AP (%). Within each dataset row, the highest, second highest, and third highest ACC are shaded red, orange, and yellow, respectively. The ProGAN row label cell shaded green to indicate the GAN training source.
Method (ACC/AP ())
Dataset
CNNNSpot
LGrdd
UniTD
NPR
RINE
VIB-Net
Ours
Ours insermediute
PooGAN
99.99/99.99 99
09.80999.90 90
99 09,00/100.00
99,80/100.00
100.001100000
99,99/100.00
99.83/100.00
100,00/100
CycleGAN
87.59/96.40 40
86.9694.01
98.50/99. 21
96.10/98.50
99.32/99. 99
99.00/99.88 800
88.38/99.74
93,07/99. 99
BigGAN
11.1887.50
85,63/0075
94,50/98.3 31
84.4087.80
99.60999.9 94
95.75/99.2
90.08/99.53
82.05/99.94
StyleGAN
89.95/9694
91,08/99.88 80
84,40997 98
97. 77.7099.80 80
88 8..6699944 44
91 11.25/88.7 79
91.37/98
93,41/100.
StaGAN
91.6094.21
99.27/99 98
95.85/99 35
99 10.30999.00 9,0
99.55/100.00
98 98.95/99.72
97,45/99.87
100,00/100.00 .0
GauGAN
41.44/8.28
72.49/79.29
99,50/99.80 80
82 50,85000
99.77/100.00
99.7099.99
82.32/99.99 99.9
68,33/99.98
Deepfake
51 4966444
56,42/71.77 11
17.40882.00 04
80 20/82.40
80.57/97.00 90
83 21/20/22.6 64
83, 83/98/92.99 97
82.48/9688 82
SAN
50.0055.89
44,47/45.09
56.50892 18
69 (9.200/71.60
68.26/94,0 MU
70.5091 /62
86. 0t.9992.25 25
93.61N77 94
SDVL4
50.82/52.86
63.03/70.90
63.10/85..4 .88
76.60/44.00
83, $3,96/98.35 35
71. 71.55/87.24 224
85,79/92.22 25
98.82/99. 94
SDVL5
50.88/53.25
63.67/71722
63.57/82.20
73 17.90884.60
83.35/98.38 33
70.00886.99
85. 14/92.22
98, 38.67/99.
ADM
60.2066.11
67. 07,10771. 83
66. S1.99194444 34
69 70/74.66
74.61199, 25
71 45/87 88
81. (1.4669.66 61
93.01197.7 70
GLIDE
$7.85/68.10
61,70/841.04 66.1075.96
77. 77.30085,70
80.72/97.87
69. 19.40/88.55 53
89.72/96.39
97,02/99.56
Midjourney
50.77/56.60
56.20/71.42
57.85169.05
77 80885
57.12/87.41
25/755668
60.36/666.8
Wakong
$1.13/51.15
63.60066511
71 71,06/9011 1.5
76. 10/50.50
84.955/9 612
75 90/0092
88. 36/95 338
9% 98.62/99 888.
VQDM
56.20/69.49
67.02/70.23
85,00/94.96
78. 1,221.20
89.79/99.25 25
86 86.65/96.51
$6.72/96.06 0S
97./9/99.74
Avg
66.95/74.02
72.19/78.61
77.72/89.95
82 84/8677
86.03/97.88
82.97/93.04
86.66/94.10
91,07/98.25
Table 3: Training from SDV1.4 Cells show mACC/mAP (%). In our setup, base trains only on SDV1.4 without 3DGS; Oracle is jointly trained on SDV1.4 plus {GHA, SA, GAGAvatar) in a non-continual manner, and iCaRL, CBRS, and our HGR are sampling methods for the replay buffer. Bold highlights the best mACC among the sampling methods only.
Method
Ditfusion
GANs
Others
GHA
SA
GAGAvatar
Average
UniFD RINE
71.04/87.14
58.83/61.00 .01
65.20/76.79
54.75/54.03
58.35/54.87
55.85/56.89
63.87/71.0
72.00/96.53
58.48/88.58
56.95/84.50
50.00/60.20
50.00/55. 10
50.60/59.70
62.20/86.20
hase
95.43/99.83
94.85/99.20
85.37/94.67
66.05/78. 10
64.65/80.66
50,39/54.56
88.27/94.26
iCaRL
96.00/99.65
91.57/97.61
78. 18.13/33.34
96.01/99.88
94.99/99.80 80
04.52/99.12
92.40/98.26
CBRS
95.15/99.68
93.15/98.60
77.58/94.24
23/93/99.78
96.58/99.97
96.02/99.50
92.66/98.73
HGR
97.12/99.81
94.00/99.07
82.31/94.29
97.06/99.77
98.07/99.99
95.18/99.07
94.38/98.92
Oracle
95.54/99.76
95.62/99.39
78.39/96.08
94.57/98.86
98.67/99.94
94,90/99.08
93.75/99.
4.3 CONTINUAL ADAPTATION TO 3DGS DOMAINS
We evaluate sequential adaptation to three 3DGS domains (GHA, SA, GAGAvatar), averaging over all six permutations of arrival order. and report group means for Diffusion, GANs, and Others (Deep- fake, SAN), per-domain 3DGS columns, and an all-targets average over 18 datasets. In our setup, base trains only on SDV1.4 or ProGAN without 3DGS and Oracle jointly trained on the base plus 3DGS domains in a non-continual manner. We also report the performance of the pretrained UniFD and RINE models. We can see that the pretrained UniFD and RINE models struggle to de- tect synthetic images generated by 3DGS. iCaRL, CBRS, and our HGR are sampling methods for the replay buffer whose scores are averaged across arrival orders. In the tables, boldface marks the best mACC among sampling methods only (iCaRL, CBRS, HGR). With an SDV1.4 1.4 start (Table B}. HGR achieves the highest overall mean among sampling methods and even surpasses the non non-continual oracle; 3DGS, HGR leads GHA and SA, while CBRS is slightly higher on GvGAvatar. With a ProGAN start (Table 4). HGR again delivers the best overall mean among sampling methods and clearly improves the GANs group relative the base; within 3DGS, CBRS tops GHA and GAGA- vatar, whereas HGR peaks on SA. The base and Oracle serve as reference points rather than direct competitors; across both initializations, HGR is the most effective sampling strategy, with CBRS offering targeted gains on specific 3DGS regimes.
4.4 ABLATION ON HSIC COMPONENTS AND INTERMEDIATE FEATURES
Table 5alee5exxae exxamines (left) the roles of HSIC(,, 2), HSIC 2), and intermediate ViT/CLIP representa- tions, and (right) the choice of HSIC kemnelbaandwidin Enforcing HSIC(y, 2) consistently strength- cross-generator generalization by aligning the latent with task-relevant variation, while HSIC(z,
8

---

Published as a conference paper at ICLR 2026
Table Training from ProGAN. Cells show mACC/mAP (%). In our setup, base trains only on ProGAN without 3DGS; Oracle is jointly trained on ProGAN plus (GHA, SA, GAGAvatar) in non-continual manner, and iCaRL, CBRS, and our HGR are sampling methods for the replay buffer. Bold highlights the best mACC among the sampling methods only.
Method
Diffusion
GANs
Others
GHA
SA
GAGAvatar
Average
UniFD
67.03/84.34
95.44/99.1 11
61.95/82.11
53. $3.10/56.33
86.10/95.41
65.45/76.54
76,14/87.66 .644
RINE
79.21/96.58
97.85/99.90
74.42/96.42
54.20/66.00
79.30/92.90
61.00/77.30
82.50/94.69
base
93.29/97.02
89.48/99.99
88.05/97.38
51.25/74.75
55.78/94.09
61.98/73.83
85.28/95.36
iCaRL
76.79/91.10
28.84/94.74
78.90/92.80
95.23/99.86
97. 97.47/99.99
96,93/99.8
84.33/93.96
CBRS
80.33/92.97
89, 89,99/95.34
77.55/90.63 63
97.82/99.85
98. 00.007010000
98.09/99.89
86. 18/94,66
HGR
82.87/94.33
93.94/98.85
80.99/90.72
94.71/99.47
99.45/100.00
95,47/99.22 26
88.63/96.31
Oracle
82.15/95.58
96. 10/99.722 85.15/97.11
90.90/96.66
98.81/99.96
90.98/97.06
89 09.90/9982
Table 5: HSIC ablations (component/nnermeelit the left; kernel/bandwidth the right). We report mACC/mAP (%) on SDV1.4 and ProGAN. (a) toggles HSIC(>, =), HSIC(y, 2), and the use of intermediate ViT features; the full configuration (both HSIC terms intermediates) attains the best overall performance. (b) compares HSIC kernels and bandwidths (σ)); an RBF with the median heuristic performs best and adopted default. Bold marks the top mACC per dataset.
(a) Ablations on HSIC components and intermedi-
(b) Ablations HSIC kernel and bandwidth. "IMQ" ate features. V= enabled, X= disabled. We report denotes the inverse multiquadratic kernel. We report
mACC/AP (%) on SDV14 ProGAN.
mACC/mAP (%) on SDVL4 and ProGAN.
HSIC
HSIC Interned.
SDV1.4
ProGAN
Kernel
SDV1.4
ProGAN
x
X
89.20 19.20/96.77
83.30/90.26
Cosine
88.70/98.0 64
91.49/97.22
89.75/96.66
83.29/90.22
91 61/644977 34
87.05/94.45
IMQ
92.79/98.59
89.23/97.50
92.22/98.31
89.22/95.62
RBF (a = -1)
92.75/98.72
88.82/97.89
91 91.69/97.10
86.66/94100
RBF (a =
92.71/98.55
90.50/97.55
X
39.39998880
90.67/97.78
RBF (Ø 3)
93.14/98.71
90.83/97.48
87.1 17.12/93.70
/
93.86/98.89
91007/98.25
RBF (a median)
93.86/98.89
91.07/98.25
2) acts as a complementary regularizer that discourages input-anchored shorteuts and stabilizes op- timization; using both terms together yields a representation that preserves prior competencies yet remains adaptable. Enabling intermediate features improves both accuracy and ranking across all configurations, indicating that earlier layers expose generator cues that the HSIC bottleneck can regularize toward invariance.
For the dependence measure, Cosine and IMQ perform competitively, but an RBF kernel with median hcuristic provides the most stable behavior across both SDV1.4 and ProGAN bases, likely due to its scale adaptivity without manual tuning. For additional ablation studies, please refer to Appendix A
4.5 DOMAIN-INCREMENTAL CATTVALLLLANIIEE LEARNING ANALYSTS
In this section, we study the forward and backward transfer of HGR. We report per-dataset detection performance (mACC/mAP) for the arrival order whose final mACC is closest to the mean over all six permutations of arrival orders; in each subtable, the first row lists the chosen sequence (starting from the base), and the column shows the performance after the dataset has arrived. Forgetting con- centrates on out-of-domain targets; for example, when training from SDV1.4, degradation is most pronounced on GANs and Others (and symmetrically, diffusion degrades when starting from Pro- GAN), though the effect remains modest under our rehearsal budget. At the same time, new domains provide positive transfer by exposing the model to additional artifact patterns and scene statisties, yielding consistent gains on datasets related to the most recently trained domain and smaller but nontrivial improvements some cross-generator targets.

---

Published as a conference paper at ICLR 2026
Table 6: Inmaennnneremmnttl learning analysis. Each subtable shows the arrival order whose final mACC is closest to the mean over all six permutations of arrival orders; the first row lists the selected sequence, and the column shows the performance after the dataset has arrived. The numbers highlighted in gray indicate that their corresponding 3DGS datasets have not yet been included in the domain-incremental training.
(a) Starting from SDV144 then SA, GAGAvatar, and GHA arrived sequentially, Forgetting happened mostly on GANs and Others.
(b) Starting from ProGAN, then SA, GHA, and GAGAvatar arrived sequentially, Forgetting happened
mostly on Diffusion and Others.
Dataset
SDVL4
SA
GAGAvatar
GHA
Daliet
ProGAN
SA
GHIA
GAGAvaaarr
Diffusion
95,43,99.33
97.41.99.88 84
97 59/99.91
96.90/99.79
GANs
89.48/99.9
91.96999.77
89 89.56/99.42
93.15999 39
92.7498.60
94.36/9.122
93.24/98.79
Others
38,05/97.38
76.8494
83. 13.28.94.55
82.82/92.11
Others
81.01/96.35 64165599.66
85.37/91.67
76.79/93.93
84/43/93.06
Diffasion
03.29/97.02
85.35/94
67.67.04.75
84.66/9366
SA
97.01199.88 83
99 99.86100.00
98.99/100.00 00
55.78/95.09
94.17/100.00
100.00/100:00
99,55/100000
GAGAvater
50, 20.39/54.55 56
64.9189999 93
99 37.37999.9
94. 17/99.51
GIIA
51.25/74.75
66. (6.71188
96. 06.23/99.93
92.57/99.0 03
GHA
66.05/78.11
66.67/86
66.41/84.82
90.80999994
GAGAvattr
61. 61.98/73.85
50.23/71 .24
55. 11/68.898
98,49/99 88
Average
88.27/4.36
90.8396666
92.70/98.11
94. 34.36/9.71
Average
85,28/95.8
84.10/95.11 11
87.17/98.43
89,33/96.40
5 DISCUSSION
5.1 FUTURE WORK
In this section, we discuss several special scenarios that we have not yet explored. First, we do not evaluate extremely low-resolution inputs (e.g.. 32 32, 64 64) or heavily post-processed images (e.g., strong JPEG compression, Gaussian blur). Our detector is built on CLIP ViT, which assumes inputs of least 224 x 224, and the synthetic image datasets we use typically have resolutions between 256 x 256 and 512 x 512. In practice, we envision handling such cases with a separate ro- bustness module tailored severe degradations. Second, we do not evaluate adversarial robustness (e.g., FGSM/PGD attacks) in this work. A natural extension is to combine HSIC-Guided Replay with adversarial training: adversarially perturbed real and synthetic images could be injected into the replay buffer. Third, our 3DGS experiments currently assume balanced real/synthetic splits. Studying highly imbalanced regimes (e.g.. 1:5, 1:10) and comparing different rebalancing strategies (class weighting, resampling, or hybrid schemes) is left for future work.
5.2 EXTENSIONS
This paper focuses on synthetic image detection. Extending the HSIC bottleneck to multi-modal inputs, such as synthetic 3D point clouds, is an exciting direction for future work. At present, aggregate CLIP intermediate and final layers by simple concatenation; exploring alternative aggregation schemes (e.g., attention-base fusion) is another promising avenue. We focus on CLIP ViT backbones this work and do not evaluate lighter models such as MobileNetV3 or EfficientNet- BO. Since the HSIC bottleneck itself is backbone-agnostic applying it to lightweight architectures for edge deployment is a natural extension. Finally, we do not evaluate on real-world platforms such as Reddit. Extending our benchmarks to such noisy, in-the-will wild data is important for practical deployment, and we plan to investigate this direction in future work.
6 CONCLUSION
We presented a detector that couples an HSIC bottleneck on intermediate CLIP features with HSIC- Guided Replay regularized by a k-center coverage term. The bottleneck filters text-alignment nui- sances while preserving discriminative cues, yielding strong cross- generator generalization when training on either diffusion or GAN sources. The replay mechanism selects compact, informative exemplars that stabilize continual adaptation to 3D Gaussian Splatting (3DGS) domains. Across SDV1.4- and ProGAN-based training, our method achieves consistent gains in both mACC and MAP, maintains performance on earlier targets, and shows low variance under different 3DGS or- derings. To support rigorous study of rendered-fakes, we curated three 3DGS head avatar datasets spanning multi-view reconstruction, single-vies view reconstruction, and generative method. To the best of our knowledge, we are the first to introduce a photorealistic 3DGS Synthetic Image Bench- mark, together with continual learning solution tailored to this setting.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGEMENTS
This work was supported in part by NSTC Graduate Research Fellowship, NSTC grants 112-2221- E-A49-100-MY33, 113-2221-E-001-000-M1
113-2221-E-002-1222MM of Taiwan, NTU grant NTU-CC 115L890903 and Taiwan Centers of Excellence (TCE), We thank the National Center for High-performance Computing for providing computing resources.
ETHICS STATEMENT
Our study uses only publicly available image datasets containing human faces, accessed and used under the research licenses of the datasets. We conducted no interaction or intervention with indi- viduals and accessed private non-public data. We process facial imagery solely for research on synthetic image detection, apply data minimization and security safeguards consistent with the dataset licenses, and report only aggregate results. We do attempt identify, profile, tar- get individuals. We have carefully considered potential impacts and do not anticipate ethical risks beyond those commonly encountered in computer vision and machine learning research.
REPRODUCIBILITY STATEMENT
We document the training pipeline and evaluation protocols in both the main paper and the ap- pendix, with explicit hyperparameters and dataset partitions to support exact replication. We also describe implementation settings and reporting conventions to match our results. To further enable reproducibility, we will release the full training and evaluation code, along with runnable scripts.
THE USE OF LARGE LANGUAGE MODELS (LLMS)
We used LLMs to assist with (i) polishing prose (grammar, flow, and clarity), (ii) reorganizing and tightening section structure, captions, and titles, and (iii) brainstorming keywords and query strings to surface related work.
For literature discovery, the model suggested search terms and produced brief summaries to orient the authors. Every citation in the paper was located through standard search engines digital libraries and then read and verified by the authors; we did not accept model-generated references without inspection. Numerical results, comparisons, and quotes original sources.
cross-checked against the
We edited all mugel-suggested text for accuracy and originality and ensured that the writing reflects our intent. No confidential or sensitive data were shared with the model. The final manuscript, including all tables and figures, reviewed end-to-end by the authors for factual correctness and completeness.
REFERENCES
Rahaf Aljundi, Francesca Babiloni. Mohamed Elhoseiny, Mareus Rohrbach, and Tinne Tuytelaars. Memory aware synapses: Learning what (not) to forget. In Computer Vision ECCV 2018: 15th European Conference, Munich, Germany, September 8-14, 2018, Proceedings, Part III, pp. 144- 161, 2018
Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale GAN training for high fidelity natural image synthesis. In International Conference Learning Representations, 2019.
Lucy Chai, David Bau, Ser-Nam Lim, and Phillip Isola. What makes fake images detectable? understanding properties that generalize. European Conference on Computer Vision, 2020.
Baoying Chen, Jishen Zeng, Jianquan Yang. and Rui Yang. DRCT: Diffusion reconstruction trastive training towards universal detection of diffusion generated images. In Forty-first Interna- fional Conference on Machine Learning, 2024.
11

---

Published as a conference paper at ICLR 2026
Yunjey Choi, Minje Choi, Munyoung Kim, Jung-Woo Woo Ha, Sunghun Kim, and Jaegul Choo. Star- GAN: Unified generative adversarial networks for multi domain mmage-t--image translation. In 2018 IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 8789-87899999 2018.
Charis Chrysakis and Farhad Pourkamali-Anarahe Online continual learning from imbalanced data. In International Conference on Machine Learning, pp. 1673-1682. PMLR, 2020.
Xuangeng Chu and Tatsuya Harada. Generalizable and animatable gaussian head avatar. In The Tiihth Annual Conference on Neural Information Processing Systems, 2024.
Tao Dai, Jianrui Cai, Yongbing Zhang, Shu-Tao Xia, and Lei Zhang. Second-orde attention network for single image super-resolution. 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 1 11077-11066 2019.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat GANs on image synthesis. In Advances in Neural Information Processing Systems, pp. 7780-8794, 2021.
Guy Gafni, Justus Thies, Michael Zollhöfer, and Matthias Nießner. Dynamic neural radiance fields for monocular 4D facial avatar reconstruction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 8649-8658, 2021.
Teofilo Gonzalez. Clustering minimize the maximum intercluster distance. Theoretical Com- puter Science, 38:293-306, 1985. doi: 10. 12.111600004-37555555)000
Philip-William William Grassal, Malte Prinzler, Titus Leistner, Carsten Rother, Matthias Nießner, and Justus Thies. Neural head avatars from monoeular RGB videos. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pp. 18653-18664, 2022.
Arthur Gretton, Olivier Bousquet, Alex Smola, and Bernhard Schölkopf. Measuring statistical de- pendence with Hilbert-Schmidt norms. In Algorithmic Learning Theory, pp. 63 2005.
Shuyang Gu, Dong Chen, Jianmin Bao, Fang Wen, Bo Zhang, Dongdong Chen, Lu Yuan, and Baining Guo. Vector quantized diffusion model for text-to-imare synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10696-10706, 2022.
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of GANs for im- proved quality, stability, and variation. In International Conference on Learning Representations, 2018.
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative ad- versarial networks. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 4396-4405, 2019.
James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A. Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Graabsa-Barwinsse Demis Hass- abis, Claudia Clopath, Dharshan Kumaran, and Raia Hadsell. Overcoming catastrophic forgetting in neural networks. Proceedings of the National Academy of Sciences, pp. 3521-3526, 2017.
Tobias Kirschstein, Shenhan Qian, Simon Giebenhain, Tim Walter, and Matthias Nießner. NeRSem- ble: Multi-view radiance field reconstruction of human heads. ACM Trans. Graph., 2023.
Christos Koutlis and Symeon Papadopoulos. Leveraging representations from intermediate encoder- blocks for synthetic image detection. In Computer Vision ECCV 2024: 18th European Confer- ence, Milan, Italy, September 29- October 4, 2024, Proceedings, Part LXXII, pp. 394-411, 2024.
Zhizhong Li and Derek Hoiem. Learning without forgetting. IEEE Transactions on Pattern Analysis and Machine Intelligence, pp. 2935-2947, 2018
Tsung- Yi Lin, Michael Maire, Serge Belongie, Lubomir Bourdev, Ross Girshick, James Hays, Pietro Perona, Deva Ramanan, C. Lawrence Zitnick, and Piotr Dollár. Microsoft coco: Common objects in context, 2015. URL http::/t::///artt
.org/ htrg/ab//.. 1405 0312
Zhuang Liu, Hanzi Mao, Chao Yuan Wu. Christoph Feichtenhofer, Trevor Darrell, and Saining Xie. A convnet for the 2020s. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 11966-11976, 2022.
12

---

Published as a conference paper at ICLR 2026
Arun Mallya and Svetlana Lazebnik. Packnet: Adding multiple tasks to single network by iterative pruning. In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7765- 7773, 2018.
Midjoumny..
httpp:://ww.m.djuuus how.mm/ee/.cccmmmm//e/o 2022.
Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. GLIDE: Towards photorealistic image generation and editing with text-guided diffusion models. Proceedings of the 39th International Conference on Machine Learning, pp. 16784-16804, 2022.
Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detectors that generalize across generative models. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 24480-24489, 2023.
Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy Vo, Mare Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby, Mahmoud Assran, Nico- las Ballas, Wojciech Galuba, Russell Howes, Po- Yao Huang, Shang- Wen Li, Ishan Misra, Michael Rabbat, Vasu Sharma, Gabriel Synnaeve. Hu Xu, Hervé Jegou, Julien Mairal, Patrick Labatut, Ar- mand Joulin, and Piotr Bojanowski. Dinov2: Learning robust visual features without supervision, 2024. URL htt.s:tssss..... http:///aaxxvvvvo htt.a/abb.2330..2 200.34014.33333
Taesung Park, Ming- Yu Liu, Ting-Chun Wang, and Yan Zhu. Semantic image synthesis with spatially-adaptive normalization. In 20/9 IEEF/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 2332-2341, 2019.
Yuyang Qian, Guojun Yin, Lu Sheng. Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by mining frequency-aven clues, 2020. UtL.https://erxiv.oom org.abs//r///////////////../ 2007. 09355
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and llya Sutskever. Learning transferable visual models from natural language supervision. CoRR, abs/2103.00020, 2021. URL
wtt.aa////11..... 00020
Selvestrre-Avise Rebuffi, Alexander Kolesnikov, Georg Sperl, and Christoph H. Lampert. iCaRL: Incremental classifier and representation learning. In 2017 IEEE Conference Computer Vision and Puttern Recognition (CVPR), pp. 5533-5542, 2017.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. Proceedings of the IEEE/CVF Con- ference Computer Vision and Pattern Recognition, pp. 10684-10695, 2022.
Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießnner FaceForensics++: Learning to detect manipulated facial images. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2019.
Andrei A. Rusu, Neil C. Rabinowitz, Guillaume Desjardins, Hubert Soyer, James Kirkpatrick, Koray Kavukcuoglu, Razvan Pascanu, and Raia Hadsell. Progressive neural networks. CoRR, 2016.
Ozan Sener and Silvio Savarese. Active learning for convolutional neural networks: A core-set approach. In International Conference on Learning Representations, 2018
Zhijing Shao, Zhaolong Wang, Zhuang Li, Duotun Wang, Xiangru Lin, Yu Zhang, Mingming Fan, and Zeyu Wang. SplattingAvatar: Realistic Real-Time Human Avatars with Beesh-Emeedded Gaussian Splatting. In Proceedings of the IEEE/CVE Conference on Computer Vision and Patlern Recognition (CVPR), 2024.
Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, and Yunchao Wei. Learning gradients: Generalized artifacts representation for GAN GAN-generated images detection. In Proceedings of the IFFF/CVF Conference Computer Vision and Pattern Recognition, pp. 12105-12114, 14, 2023.
13

---

Published as a conference paper at ICLR 2026
Chuangchuang Tan, Huan Liu, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethinking the up-sampling operations in CNN-based generative network for generalizable deep- fake detection. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 28130-28133 2819, 2024.
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aurelien Rodriguez, Ar- mand Joulin, Edouard Grave, and Guillaume Lample. Llama: Open and efficient foundation language models, 2023. URL htt.t:::///ee.....tee www.wvo.rrggeeee www./brg///eooooooeo.o./oeeeeeee 13971
Qiang Wang, Xiang Song, Yuhang He, Jizhou Han, Chenhao Ding, Xinyuan Gao, and Yihong Gong. Boosting domain incremental learning: Selecting the optimal parameters is all you need. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 4839-4849, 2025.
Sheng-Yu Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. CNN-generated images are surprisingly easy to spot...for now. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8695-8789 8704, 2020.
Zhendong Wang. Jianmin Bao, Wengang Zhou, Weilun Wang. Hezhen Hu, Hong Chen, and Houqiang Li. Dire for diffusion-generrated image detection. In 2023 IEEE/CVF International Conference Computer Vision (ICCV), pp. 22388-22399 2023a.
Zifeng Wang. Zheng Zhan, Yifan Gong, Yucai Shao, Stratis Ioannidis, Yanzhi Wang, and Jennifer Dy. DualHSIC: HSIC-bottleneck and alignment for continual learning. In Proceedings of the 40th International Conference on Machine Learning, 2023b.
Wukong. https: http://hww..mnttooprrereeeeedeed
2022.
Yuelang Xu, Benwang Chen, Zhe Li, Hongwen Zhang, Lizhen Wang, Zerong Zheng, and Yebin Liu. Gaussian head avatar: Ultra high-fidelity head avatar via dynamic gaussians. In Proceedings of the JEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024.
Shipeng Yan, Jiangwei Xie, and Xuming He. Der: Dynamically expandable representation for class incremental learning. In Proceedings the IEEF/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 3014-3023, 2021.
Yongqi Yang, Zhihao Qian, Ye Zhu, Olga Russakovsky, and Yu Wu. D3: Scaling up deepfake de- tection by learning from discrepancy. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2025.
Friedemann Zenke, Ben Poole, and Surya Ganguli. Continual learning through synaptic intelligence. In Proceedings of the 34th International Conference on Machine Learning Volume 70, pp. 3987- 3995, 2017.
Haifeng Zhang, Qinghui He, Xiuli Bi, Weisheng Li, Bo Liu, and Bin Xiao. Towards universal Al- generated image detection by variational information bottleneck network. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 23828-23837, 2025.
Yufeng Zheng, Victoria Fernández Abrevaya, Marcel C. Bühler, Xu Chen, Michael J. Black, and Otmar Hilliges. IM Avatar: Implicit morphable head avatars from videos. In Computer Vision and Puttern Recognition (CVPR), 2022.
Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A. Efros. Unpaired image-to-image translation using cycle-consistent adversarial networks. In 20/7 IEEE International Conference Computer Vision (ICCV), pp. 2242-2251 2017.
14

---

Published as a conference paper at ICLR 2026
A APPENDIX
A.1 ROBUSTNESS OF CROSS-GENERATOR SYNTHETIC IMAGE DETECTION
Figure plots mean accuracy with across-seed standard deviation shown as error bars. Variation is consistently small: for most targets, the standard deviation is roughly 0 to 1.5 percentage points, with slightly larger yet still bounded spreads on a few harder sets such as Midjourney, GauGAN, and Deepfake. Overall accuracies remain high, typically in the 80 to 90% range, and several tar- gets approach 100%. The tight uncertainty bands indicate robustness to random initialization and optimization noise and support the conclusion that our HSIC-based training yields reliable cross- generator synthetic image detection.
A.2 PRETRAINED MODEL CHOICE
Figure 4 compares three feature extractors: CLIP ViT-L/14, CLIP ViT-B/16, and DINOv2 VIT-L/14. CLIP VIT-L/14 is our default and consistently delivers the highest accuracy across most datasets. CLIP ViT-B/16 follows closely, typically trailing by about 1 percentage points, which indicates that the method is not overly sensitive to model scale within the CLIP family. DINOv2 ViT-I/14 lags more clearly, particularly on targets produced by GANs and on Deepfake, where the gap can widen to roughly 10 to 30 percentage points. These trends suggest that image-text pretraining in CLIP exposes generator-related artifacts more effectively, while the improvements we observe are largely attributable to the HSIC-based training objective rather than reliance single backbone.
A.3 BLOCK-WISE EFFECTS OF INTERMEDIATE FEATURES
Figure 5 performance when evaluation is restricted to a single CLIP ViT block. At inference time, we zero out features from all non-target blocks and retain only the target block.
Across most GAN families (ProGAN, StyleGAN, StarGAN; and to a lesser extent CycleGAN and BigGAN), we observe broad mid-to-late plateau: many adjacent blocks yield comparable mean accuracy, indicating robustness to modest shifts in the chosen block. In contrast, GauGAN exhibits a narrow late-layer peak with steep degradation outside that region. Because our protocol fixes the intermediate block globally for efficiency and fairesss, the choice that best serves the majority becomes suboptimal for GauGAN-accuuning for its weaker row in Table 2
When GauGAN performance is prioritized, two lightweight adjustments help: (i) aggregate a small window of adjacent late blocks to form a multi-block feature; or (ii) apply an HSIC pyramid that reg- ularizes over neighboring blocks, capturing late-layer signal while preserving the plateaued behavior on other models.
A.4 ANALYSIS OF LEARNED REPRESENTATIONS
Figure 6 and Figure visualize feature geometry before and after applying the HSIC bottleneck using t-SNE. For each target dataset, the upper panel shows pretrained CLIP embeddings x and the lower panel shows learned embeddings z after training on SDV1.4 in Figure and on ProGAN in Figure blue denotes real and orange denotes synthetic. Relative to x, forms tighter within-class clusters and larger margins between real and synthetic across generators, with the effect most visi- ble for transfer from diffusion to GAN and from GAN to diffusion. This matches the objective: the HSIC term with labels increases between-class separation, while the HSIC term with inputs reduces reliance on input-specific artifacts and lowers within-class variance. When trained on SDV1.4, 1.4 real clusters in z become more senerator-agnostic and synthetic clusters move closer together, indicat- ing stronger alignment across models. When trained on ProGAN, z sharpens separation GAN targets and increases margins on diffusion targets, though small pockets of overlap remain for cer- tain datasets, such GauGAN. Overall, these t-SNE views corroborate the quantitative results by showing that the HSIC bottleneck reshapes features toward ceneratorrinvarian yet discriminative structure.
15

---

Published as a conference paper at ICLR 2026
FWCC
Figure 3: Per-dataset accuracy with variability. Bars show the mean accuracy over 5 runs; errоr bars denote the across-seed standard deviation. Colors compare detectors trained on SDVL4 (blue) versus ProGAN (orange).
100
CLESITOU
CUPNITSI
20.2.
20V2.5
ADM
0.02
V00N
PMGAA
CyclGGN
GkgCAM
StnCAAM
Gaulzai
Doeplabe
SAN
Figure Pretrained model choice. We extract frozen features from three pretrained mod- CLS ViT-L/14, CLIP ViT-B/16, and DINOv2 ViT-L/14-and train the detector on SDV1.4 1.4. The figure reports accuracy for each target dataset.
MACC by Block (AIl Models)
300
ProAA
TNCC 060
CycleGA
BigGAN StarDAN
Figure 5: Where the signal lives: block-wise test accuracy across GAN families. Each group reports accuracy when the detector uses only one CLIP ViT intermediate block (non-target blocks are zeroed at inference).
16

---

Published as a conference paper at ICLR 2026
Figure 6: t-SNE of test features across generators (upper: x, lower: z), trained on SDVL.4 For each test set (columns grouped by generator; rows per dataset), the upper panel shows embeddings of the pretrained CLIP features x, while the lower panel shows embeddings of the features learned by training on SDV1.4 with the HSIC bottleneck. Points are colored by ground truth (blue = real, orange synthetic). Relative x, the HSIC-trained generally yields tighter, better-separated clusters of real versus synthetic across both diffusion and GAN generators, indicating improved transferable separability.
17

---

Published as a conference paper at ICLR 2026
Figure 7: t-SNE of test features across generators (upper: x, lower: z), trained ProGAN. For each test set, the upper panel visualizes embeddings of the pretrained CLIP features v, and the lower panel shows embeddings of the features learned by training with the HSIC bottleneck on ProGAN. Points are colored by ground truth (blue real, orange synthetic). Relative to r, the HSIC-trained z typically exhibits tighter clusters and larger margins between real and synthetic across both GAN and diffusion generators, indicating improved transferable separability from -oraiied detector.
18

---

Published as a conference paper at ICLR 2026
Batch Size
vs Batch Size
PoGAk 5DV1.
100.0
54
97.5
03.0
30
07.5
mIAC (N)
90.0
36
07.5
85.0
ProCSAN
5DV11
125 230
128
235
Figure 8: Batch-size ablation for the HSIC bottleneck. Mini-batch size varies across (64, 128, 256, 512, }024} with all other settings fixed. The left panel reports mean accuracy and the right panel reports mean average precision. Curves shown for SDVI.4 in orange and Pro- GAN blue. Moderate batches deliver the strongest mean accuracy- -aeuuud 256 for SDV1.4 .4 and between 128 and 512 for ProGAN-win very large batches reduce accuracy for the GAN start. Mean average precision remains near saturated and largely insensitive to batch size, indicating ro- bust ranking.
A.5 ABLATION ON BATCH SIZE
Figure analyzes how mini-batch size affects cross-generator performance under the HSIC bottle- neck. Two consistent patterns emerge. First, mean accuracy follows non-monotonic trend: moving from very small to moderate batches increases accuracy, while pushing to very large batches lowers accuracy or plateau. This reflects a balance between helpful gradient noise moderate sizes and reduced variance of the HSIC estimator at large sizes that can over-stabilize updates and diminish useful stochasticity. Second, mean average precision stays high and nearly flat across the full range, indicating that ranking is robust even when the classification boundary shifts with batch size.
We adopt moderate batch size of 128 by default balance generalization and the computational cost of the quadratic HSIC term. Larger batches can be used when memory allows and when pri- oritizing stability in average precision, but they offer limited gains in this setting and can slightly reduce accuracy.
A.6 ABLATION ON ACTIVATION FUNCTIONS
Figure examines the nonlinearity used in the HSIC bottleneck head. Mean accuracy depends on the training paradigm: when trained on ProGAN, smoother bounded activations such as sigmoid and tanh yield the most reliable accuracy, whereas when trained on SDVI 1.,, linear head is preferable and ReL.U tends to underperform. This pattern is consistent with the HSIC objective: ReLU induces hard sparsification that concentrates probability mass and increases the variance of the dependence estimator, while bounded nonlincarities confine the latent to a finite range that aligns better with the radial basis function HSIC kernel; linear head preserves intermediate CLIP ViT features that already carry generator cues under diffusion training. Mean average precision remains high and changes little across activations, indicating that confidence ranking is robust even when the decision boundary shifts.
A.7 ABLATION ON HIDDEN DIMENSION
Figure examiness how the width of the HSIC bottleneck affects cross-generator performance. Ac- curacy rises as the latent becomes wider from very small to moderate sizes, then shows diminishing returns; when trained on SDV1.4 .4 the model peaks at mid sized latent, while when trained on Pro- GAN a slightly larger latent preferred. This reflects balance between capacity and regularization: a small latent space limits discrimination and increases variance in the HSIC estimator, whereas a very large latent weakens the pressure toward generator invariance and adds little utility. Mean
19

---

Published as a conference paper at ICLR 2026
MACC by Activation
by Activation
100.0
97.5
92
Tanb
45.0
87.5
I0AC (50
02
90.0
87.5
25.0
ProGAN
4
ProGAN
SEVI
Figure 9: Activation-function ablation for the HSIC bottleneck. The bottleneck head uses one of four activations: Linear, ReLU, Sigmoid, or Tanh, with all other settings fixed. The left panel reports mean accuracy and the right panel reports mean average precision when trained on ProGAN or SDV1.4. When trained on ProGAN, smoother bounded activations such as Sigmoid and Tanh deliver stronger and more stable accuracy; when trained SDV1.4. Linear head is most effective and ReLU tends to underperform. Across both cases, mean average precision remains high and largely insensitive to the activation choice.
MACC vs Hidden Dimension
MAP vs Hidden Dimension
Proak
100.0
SDV1.4
08
64
120
256
512 1024 2040
64
120 256
532
1024
2045
Figure 10: Hidden-dimension ablation for the HSIC bottleneck. The latent width of the bottle- neck head varies over dim(z) E {64, 128, 256, 512, 1024, 2048} with all other settings fixed, using radial basis function HSIC with a median bandwidth and the same training schedule. The left panel reports mean accuracy and the right panel reports mean average precision; curves are shown in orange when trained on SDVI.4 and blue when trained on ProGAN. Moderate widths perform best-when trained on SDV1.4 1.4 the model favors mid-sized latent, and when trained ProGAN a slightly larger latent preferred-whit very small widths underfit and very large widths offer diminishing returns. Mean average precision remains high and largely flat across widths, indicating robust ranking.
erage precision remains high and nearly flat across widths, indicating that the confidence ranking is stable even as the decision boundary shifts. Because the differences across reasonable widths are subtle, we adopt default latent dimension of 64 reduce parameters and runtime while preserving accuracy, and only increase the width when resources permit or target shows a clear benefit.
A.8 ABLATION ON NUMBER OF LAYERS
Figure I analyzes how the depth of the HSIC bottleneck head influences cross-generate perfor- move from single linear layer to moderate depth and then
mance. Mean accuracy improves either stabilizes or declines at excessive depth; when trained on SDV1. 1.4 the results are broadly stable once the head is moderately deep, while when trained ProGAN performance peaks mid depth
20

---

Published as a conference paper at ICLR 2026
Number of aaerss
layers
MoGak 5DV..
100.0
97.5
03.0
07.5
mACC (N)
60
90.0
07.5
85.0
ProCSAN
SDV14
Depth ablation for the HSIC bottleneck head with intermediate features. The bot- tleneck depth varies over L E 21,2,3, 4, 5, 6} while width, kemel, and schedule are fixed. The left panel shows mean accuracy and the right panel shows mean average precision; curves in blue indicate training on ProGAN and curves in orange indicate training on SDV1.4. Mean accuracy is highest moderate depth: aceuracy rises from shallow heads, then plateaus for SDV1.4 and declines for very deep heads when trained on ProGAN. Mean average precision remains high and largely insensitive depth, indicating robust ranking.
Figure 11:
Table Ablation HSIC relevance in bers denote (mACC/mAP).
Replay (HGR) on the SDV1.4 source. Num-
Method
Diffusion
GANs
Others
GHA
SA
GAGAvatar
Average
HSIC selevance
95.39/99 80
94.15/99.13
82.99/94.42
94.75/99.66 62
99.06/99.98
95.92/99.13
93.80/98.94
HGR
97.12/99.81
94.00/9.007
82.31/94.29
97.06/99.77
98.07/99.99
95. 18/99.09
94.38/98.2
and drops for very deep heads. This follows the bias-variance behavior of dependence estimation: shallow heads underfit and limit the expressiveness of the latent representation, whereas very deep heads over-shape features, increase estimator variance, and erode generator invariance. Mean aver- age precision remains high and largely unchanged across depths, showing that confidence ranking is robust even as decision boundaries shift with capacity. Because differences across reasonable depths are subtle, we use a single layer by default for both SDV1. 1.4 and ProGAN to reduce parameters and computation, and increase depth only when clear gains observed.
A.9 ABLATION OF HSIC RELEVANCE HSIC-GUIDED REPLAY
We further conduct an ablation isolate the contribution of the HSIC relevance term in equation T0 To this end, we construct a k-center only variant by removing the HSIC component and setting Akc= so that exemplar selection is governed solely by the normalized coverage score (t). i.c., (t) = 1 (d)())) This configuration corresponds to a pure coreset-style selection in feature space and serves as competitive baseline to assess the added value of HSIC-guided relevance. As shown in Tables 7 and 88 HGR improves the average performance, particularly on Diffusion and GHA domains, while the k-center only variant can occasionally perform slightly better on individual generators or categories.
A.10 EFFECT OF HSIC BOTTLENECK ON TEXT-ALIGNMENT SEMANTICS
To quantify how the HSIC bottleneck reshapes CLIP features with respect to text alignment, we measure the cosine similarity between image features and text features on the ProGAN testing set. For each class label c E {airplane, bicycle.,.... ee......... t Evmonite tor), we compute the cosine sim- ilarity between the CLIP image embedding and the CLIP text embedding of the prompt "an image of (c)". The blue bars in Fig. 12 correspond to the original CLIP image features (before applying the HSIC bottleneck). Across all classes, the cosine similarities are consistently around (. 0..88-.... 0..80. indi-
21

---

Published as a conference paper at ICLR 2026
Table Ablation of HSIC relevance in HSIC-Guided Replay (HGR) on the ProGAN source. Num- bers denote (mACC/mAP).
Methed
Diffusion
GANs
Others
GHA
SA
GAGAvatar
Average
w/o HSIC relevance
77.54/93.55
94.35/98.89
77.95/89.48
91.49/99.36 94.71/99.47
99.60/99.99 99.45/100.00
9/931/
86. 86.23/95.89
HGR
82.87/94.33
93.94/98.85
80.99/90.72
95.47/99.26
88.63/96.31
Cosine Similarity Comparison
0.25
Original
HSC bottleneck compressed feature
0.20
Simiarty
0.15
0.30
0.05
0.00
peglang
blyalle
Hestle
dhinglable
Nerse
matarbile
Rottmdaiden
train
tnmonita
Figure 12: Cosine similarity between image and text features the ProGAN test set. For each class c, we compute the cosine similarity between the CLIP image feature and the CLIP text feature of the prompt "an image of (c)". Blue: original CLIP features, which exhibit strong text alignment across all classes. Orange: HSIC bottleneck compressed features, whose cosine similarity to the same text prompts is dramatically reduced, showing that the HSIC bottleneck suppresses text-alignment semantics.
cating that the original features preserve strong text-alignment semantics even for ProGAN synthetic images.
After training with the HSIC bottleneck loss, recompute cosine similarities using the compressed features (orange bars in Fig. 12). These similarities drop to around 0.01 for every class, approaching This substantial and systematic reduction demonstrates that the HSIC bottleneck effectively suppresses the alignment between image features and the corresponding text prompts.
A.11 SENSITIVITY OF HSIC BOTTLENECK WEIGHTS
Figs. 13 and 14 visualize a two-dimensional grid search over the HSIC bottleneck weights Å₂ and
Xy on SDv1.4 and ProGAN, respectively. For each Xz, Ag E {100, 200, .... 1000), we train detector with the HSIC bottleneck and report the resulting mean accuracy (mACC) and mean average precision (mAP).
On 1., both mACC and mAP remain consistently high across broad range of weights, with mACC fluctuating within roughly one percentage point and mAP remaining close to 99%. The best-performing configurations tend to appear in the mid-to-high range of X and Xy but the overall heatmap exhibits a wide plateau rather than sharp peaks. This indicates that the detector relatively insensitive to the exact choice of HSIC weights and that the bottleneck provides stable gains over large region of the hyperparameter space.
A similar trend is observed ProGAN. The mACC heatmap shows only minor variation (on the order 0.5-1.0 percentage point) across the entire grid, while mAP remains around 98% for most settings, with slightly lower values only few extreme combinations. Again, the central region
22

---

Published as a conference paper at ICLR 2026
MACC per (Ax, Av)
m&P per (As, kn?
50.0
3000
97.33
1000
13.04
23.79
05.17
05.00
15.30 92.01 03.30 25.00 01.27 50.30
900-
00.73
23.32
09.05
06.00
20:07
50.33
06.00 25.20
800
47.45
43.54
97.45
83.10
10
90.0
000
42.40
48.08
600
$0.00
92.13
90.30
62.64
93:43
00.29
90.48
97.07
90.40
90.20
40.5
820
77
66
00
58.72
60.57
60.64 58.00
90.07
06.60
58:77
60
65.17
13:60
92.03 02.78
500
95.45
90.0
98.4
-0.07
03.29
03.13
13.00
03.00
00.78
13.04
01.20
00.50
05
23.33
98.53
06.77
08.73
90.00
18.33
300
65.57
11:30
95.09
55:46 19.25 50.35 30
10.13
90.23
55.00
303
15 05
166
94
95.79 19.04
56.65 15:07 99.82 16.16
15:33 50.53
100
59.55
93.63
93.09
53.09
32.94
93
05
93.47 32.85 93.19
92
100
52 01
96.8 87 98:53 90.70
96.63 98.70
90.77
55
95.76
90.50
100
100
300
402
100
800
700
000
100
1000
100
200
300
400
503
600
700
500
500
1000
Figure 13: Grid search over the HSIC bottleneck weights A and X, on SDv1.4. We sweep >e, 100, 200, ... 1000 and report the resulting mean accuracy (mACC, left) and mean average precision (mAP, right) of the detector trained on SDv1. 10lv1.4-geme. g-genrrteed images.
MACC
1000
50.00
50
50.72
90.77
50.51
10:05
90
90.59
90.79
90.33
50.15
$1.0
1000
90
25
56.33
23
55.34
50.01 90 22
55.07
98.05
56.15
15.16
97.99
900
90.6
890
00072-0
90.73 50.77
26.22
90.23
20.23
90.78
90.43 50.39
920
99.27
14
19.12
98.01
75:08
98.02
58.20
15..5
98.10
700
00.73
90.75
90.63 00.33 90.77 90.22
00.70
30.5
700
90.05
90.20
08.13
90.25 05.13 90.03
90.22
10.17 08.10
50.59
90.63
500
00.17
20.75
00.47
50.49 00.34
00.10 10.06 20.31 90.20
50.33
503
003
56.23
22
13.14
90.20
00.14
18.08 08.14
56.35
15:18
00.22
420
-0.48
00:02
90.54
10.05 30.43 00.13 50.38
20.30
92.53
50:77
303
58.00
07.04
08.23
91.59
05.28
50.07
07.07 25:04
05.52
200
80.82
90.40 60.22
90.00
90.32
200
90.10
60.29
48.17
40.77
00.17
18.10
47.50
80.5
100
300
402
500
820
000
1200
300
202
300
400
593 700
ado
500
1000
bc
22
Figure 14: Grid search over the HSIC bottleneck weights X and X, on ProGAN. We sweep An, Ag E 100, 200...., 1000 and report the resulting mean accuracy (mACC, left) and mean average precision (mAP, right) of the detector trained on ProGAN-generated images.
of the grid yields near-optimal performance, suggesting that the method does not rely on fine-tuning X₂ and X to narrow sweet spot.
Overall, these experiments demonstrate that the HSIC bottleneck is robust to a wide range of weight choices on both SDv 1.4 and ProGAN. In the remainder of the paper, we therefore fix X and Xy to a single representative configuration from the high-performing plateau for all experiments.
A.12 CLUSTERING STRUCTURE OF HSIC BOTTLENECK REPRESENTATIONS
To quantitatively assess how the HSIC bottleneck organizes different generator families in feature space, we compute two clustering metrics on the embeddings: the silhouette coefficient (higher is better, range 1-1, 1)) and the Davies-Bouldin (DB) index (lower is better). We group generators into three families Diffusion, GANs, and Others (deepfake and SAN) and report the mean silhouette / DB score for each family in Table 9 The first row (x) uses the original CLIP image features, while the second and third rows ("SDVL 1.D z" and "ProGAN 2²" use the HSIC bottleneck representations trained on SDV1.4 1.4 and ProGAN, respectively.
23

---

Published as a conference paper at ICLR 2026
Table 9: Silhouette coefficient (higher is better) and Davies-Bouldin index (lower is better) com- puted image embeddings, grouped by generator family (Diffusion, GANs, Others). The first row (I: uses the original CLIP image features, while the second and third rows ("SDV1.4 z" and "ProGAN =²") use HSIC bottleneck representations trained on SDV1.4 and ProGAN, respectively, Best values in each column are bolded.
Embedding
Training Source Diffusion
GANs
Others
x
0.03 / 5.64
0.08 3.75
0.04 5.37
2
SDV1.4 ProGAN
0.65 / 0.45
0.59 0.53
0.30 / 1.40
2
0.34 / 1.19
0.69 0.40
0.34 / 0.98
Accursc
60
SOV1-4 ProSAN
S0V2.4
SDVL5
ADM
GLOD
Hédjoumey
Wilkowp
Poodeay
Qoletae
Bjpada
Gaadle
Deopllae
SAR
GHA
Figure 15: Robustness of HSIC-Guided Replay (HGR). Bars show the mean accuracy (%) over 5 independent runs of HGR for each target generator, when trained with SDVI.4 444 (blue) or ProGAN (orange) as the source domain. Error bars denote the standard deviation across runs.
The raw CLIP features (x) exhibit very weak clustering structure across all families, with near-zero silhouette scores (0.03-0.08) and large DB indices (3.75-5.64), indicating that real and synthetic im- ages are heavily entangled in the original CLIP embedding space. In contrast, both HSIC bottleneck variants substantially improve the clustering quality: silhouette scores increase to 0.30-0.69 and DB indices drop below 1.5 for all groups. Moreover, the source domain used to train the bottleneck leaves a clear imprint on the structure: the SDVI.4-traing bottleneck yields the best clustering for diffusion models (silhouette 0.65, DB 0.45), whereas the ProGAN-trained bottleneck achieves the best scores on GANs and Others. These results show that the HSIC bottleneck not only suppresses text-alignment semanties, but also induces a more cenerator-awar structure in the representation space that reflects the training source.
A.13 ROBUSTNESS OF HSIC-GUIDED REPLAY
summarizes the results for HGR trained with SDV1.4 or ProGAN as the source domain. Across à diverse set of diffusion models, GANs, deepfake generators, and 3DGS-based head avatar models (GHA, SA. GAGAvatar), HGR achieves consistently high accuracy with small variance across runs. This indicates that our improvements are not due to a favorable random seed, and that HGR yields stable performance under repeated training.
Figure 15
24

---

Published as a conference paper at ICLR 2026
A.14 IMPLEMENTATION DETAILS
Models are implemented in PyTorch and trained on a single NVIDIA GPU with SGD (learning rate 10 10-4). The encoder fay is single fully connected (linear) layer with imput dimension 19200 and output dimension 64, and the classifier go, is also single fully connected (linear) layer with input dimension 64 and output dimension I; no activation functions are used. The HSIC bottleneck uses Gaussian RBF kernels with bandwidth set by the median heuristic. We set A 900 and Ay = 700 when training on SDV1,4 and A = 500 and X = 600 when training on ProGAN. We pick m, exemplars per class with my + m_ [keep_fze uep.frac.... NN1 where N is the total number of training samples and we set frep.frac=0.01.. We first enforce class balance and then assign any remainder to the larger class.
A.15 GENERATIVE MODELS
Our evaluation covers broad spectrum of generative models spanning early BAAN-asee architec- tures, semantic amage-to-imane models, and recent large-scale diffusion and rext-to-image systems. Below, we briefly summarize the key characteristics of each family.
GAN-based image generators. ProGAN (Karras et al., 2018) introduces a curriculum-sty train- ing schedule where both generator and discriminator are grown from low to high resolutions, greatly stabilizing GAN training and enabling 10242-resolution image synthesis on datasets such as CelebA- HQ. StyleGAN (Karras et al. 2019) builds on ProGAN with style-based generator architecture that maps a latent vector into an intermediate space and modulates features via AdaIN at each layer, yielding highly controllable and disentangled factors of variation for high-resolution face genera- tion. BigGAN (Brock et al., 2019) scales class-conditional GAN training to large ImageNet-seale datasets, combining architectural and regularization tricks (e.g.. orthogonal regularization, trunca- tion) to significantly improve fidelity and diversity in high-resolution synthesis. StarGAN (Choi amage-to-image translation. CycleGAN learns mappings between two unpaired domains using cycle-consistency losses. StarGAN general- pair, controlled by a domain label input. GauGAN (Park et al. 2019) takes structured inputs such as semantic seg- mentation maps and uses spatially-adaptivy normalization layers to preserve semantic information throughout the network, producing photorealistic scene-level images from coarse layouts.
al. 2018) and CycleGAN (Zhu et al., (017) focus
izes this idea multi-domain translation with a single manerator-discrimin
Deepfake and super-resolution generators. Beyond generic image synthesis, we also consider models that manipulate or enhance existing images. Deepfake facial manipulation is represented in our setup via methods from FaceFsrensics++ (Rossler et al. 2019), which encompasses sev- eral face- eddiieg pipelines (e.g., reenactment, replacement, and neural cexture-based manipulation) and has become de facto benchmark for evaluating forgery detectors on human faces. Although SAN (Dai et al.) 2019) is not a generative model in the strict sense, hallucinates high-frequency details from low-resolution inputs through second-order attention mechanisms. As such, SAN can act as a powerful post-processing or enhancement component in synthetic or manipulated image pipelines, and its outputs exhibit characteristic artifacts that are relevant for forensic detection.
Diffusion and latent diffusion models. ADM (Dhariwal & Nichol 2021 refines DDPMs by learning variances and using improved sampling, achieving competitive likelihoods and sample quality while reducing the number of denoising steps needed for high-fidelity images. Stable Dif- fusion (Rombach et al. (202) is latent diffusion model (LDM) that performs the diffusion process in compressed latent space rather than pixel space, enabling efficient high- resouutooottion text-to-image generation consumer GPUs. has become widely used open-source backbone for downstream fine-tuning and domain adaptation. GLIDE (Nichol et al. 2022) an early text-conditional diffu- sion model that explores classifier-based and free guidance, demonstrating strong photo- realism and text alignment along with image editing capabilities.
Industrial and specialized text-to-image systems. Midjourney (Midjourney) 2022 is a propri-
etary large-scale text-to-image model served via cloud API and Discord interface. It is trained on web-scale image-text data and optimized for artistic, stylized, and photorealistic generations; although its architecture and training data are not publicly documented, it constitutes an impor-
25

---

Published as a conference paper at ICLR 2026
Table 10: Detection accuracy (ACC, %) of baseline diffusion detectors, DRCT, and our HSIC- based CLIP detectors on the DRCT-2M benchmark proposed in DRCT (Chen et al. 2024). Ours denotes our HSIC-bottleneck model on final-layer CLIP features, while Ours w/ intermediate further incorporates intermediate CLIP features, yielding consistently higher and near-saturated accuracy across all diffusion variants.
Datasct
CNNNSpot
F3Net
CLIP/RN50
Conv-B
UnivFD
DIRE
DRCT
Ours
Ours w/ intermediate
LDM
99.87
99.85
99.00
99.97
98.30
54.62
99.66
99.07
99.96
SDv1.4
99.91
99.78
99.99
100.00
96.22
75.89
98.56
99.07
99.70
SDv1.5
99.90
99.79
99.96
99.97
96.33
76.04
98.48
99.07
99.67
SDv2
97.55
88.66
94,61
95.84
93.83
99.87
99.85
99.06
99,97
SDXL
66.25
55.85
62.08
64.44
91.01
59.90
96.10
99.06
99.97
SDXL-Refiner
86.55
87.37
91.43
$2.00
93.91
93.08
98.68
99.06
99,91
SD>Turbo
86.15
68.29
83.57
80.82
86,38
99.77
99.59
99.07
99.97
SUXL-Turbo
72.42
63.66
64,40
60.75
85.92
57.55
83.30
99.07
99.97
LCM-SDv1.5
98.26
97.39
98.97
99.27
90.44
87.29
98.45
99.06
99.97
LCM-SDXL.
61.72
54.98
$7.43
62.33
72.53
93.78
99.06
99,97
SDvI-Ctl
97.96
97.98
99.74
99.80
90.41
67.85
96.68
99.07
99,96
SDv2-Ctrl
85.89
72.39
80.69
83.40
81.06
99.69
99.85
99.06
99.97
SDXL-Cul
82.84
81.99
82.03
73.28
89.06
64.40
97.66
99.06
99.97
Avg. 87.33
82.15
85.68
84.76
90.92
77.57
96.97
99.06
99.92
tant real-world generator in current synthetic media ecosystems. VQDM (Gu al. 2022) tar- gets efficiency rather than raw generation quality: it compresses large text-to-image diffusion models such as SDXL and SDXL-Turbo using vector quantization while preserving image qual- ity and text alignment, making large generators more deployable in resource-constrained settings. Wukong [Wukong] 2022) in our context refers the Chinese eet-to-imaae diffusion line built on the Wukong- Huahua foundation model. Mukong-Huahuu is a diffusion- based generator trained on large-scale Chinese multimodal Wukong dataset (100M image-text pairs), targeting high-quality Chinese-language text-to-image synthesis and deployed on MindSpore / Ascend hardware.
Together, these models span a wide range of architectures (GANs vs. diffusion vs. latent diffusion), training paradigms (unconditional, conditional, and translation-based), and deployment regimes (open-source vs. proprietary, full-precision vs. compressed). Evaluating synthetic image detec- tors across this diverse set is crucial for assessing robustness and cross gesssree generalization.
A.16 COMPARISON ON THE DRCT-2M BENCHMARK
To assess whether our method remains effective on large-scale diffusion--ennrraee image detection, evaluate on the DRCT-2M benchmark introduced by DRCT (Chen al. 2024). DRCT-2M contains a diverse collection of synthetic images generated from multiple Stable Diffusion families and variants, including LDM, 1DSV22 SDXL, refiner and turbo variants, LCM-based accel- erations, and ControlNet-based pipelines. We follow the same training protocol to train on the real images of MSCOCO (Lin et al. 2015) and the synthetic images generated by SDV11.4 1.4, and then evaluate different testing subsets on DRCT-2M. Table 10 reports the detection accuracy of clas- sical CNN-based detectors (CNNSpot (Wang et al. 2020). F3Net (Qian et al. 2020). Conv-B (Liu al. 2022) ) CLIP-based detectors (CLIP/RN50 (Radford et al. 2021). UnivED (Ojha al., 2023 )
the diffusion-specific DIRE (Wang et al. 2023a) and DRCT (Chen et al. 2024 baselines, and our HSIC-based CLIP detectors. While DRCT already outperforms prior baselines in average accuracy, our method (Ours) further improves performance across almost all diffusion variants, and the variant that additionally exploits intermediate CLIP features (Ours w/ intermediate) achieves near-saturated performance (== 99.9%) on all generators. This demonstrates that our approach generalizes strongly diverse diffusion architectures and settings, beyond the GAN-based benchmarks considered in our main experiments.
26


Reviews:
[{"review_id": "sLiOdveC78", "reviewer": "Reviewer_cumQ", "summary": "This paper proposes a HSIC-based bottleneck to enhance the generalization of CLIP features for synthetic image detection across diverse generator families. The method encourages representations to retain label-relevant information while suppressing spurious correlations with input semantics, and further introduces HSIC-Guided Replay (HGR) to mitigate catastrophic forgetting in domain-incremental learning. Experiments on diffusion, GAN, and 3D Gaussian Splatting (3DGS) models demonstrate improved cross-generator performance and continual learning stability compared to recent baselines.", "questions": "- How does HSIC specifically reshape CLIP features at different semantic granularity levels? Can the authors provide more concrete evidence—beyond t-SNE—that illustrates which types of semantic or generator-specific correlations are suppressed?\n- How well does the method scale when extended to modern, highly realistic generators such as SD3.5, Midjourney, Sora2, or FLUX? Have the authors tested whether the model remains effective with these more challenging sources?\n- In continual learning scenarios with more than 6–8 sequential domains, does HGR maintain long-term stability? Could the authors provide results over longer task horizons to support claims of scalability and robustness?\n- What is the computational overhead of using 24-layer CLIP features + HSIC loss during training and inference? Could the model be made more efficient without sacrificing performance?\n- Several recent approaches build upon CLIP to improve cross-generator generalization, and comparing against such methods would better contextualize the contribution of the proposed HSIC bottleneck.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "- The paper articulates the challenge of detectors overfitting to generator-specific artifacts and semantics, which is a timely and relevant problem for synthetic image forensics. \n- The continual learning setting further shows practical awareness of evolving generative models, making the work meaningful for long-term applicability.\n- The adaptation of HSIC into the CLIP feature pipeline is implemented in a straightforward and principled manner, and the loss formulation is coherent with prior HSIC-based bottleneck approaches.\n- Ablation studies on HSIC components, use of intermediate ViT features, and kernel options provide supportive empirical evidence that each design choice is beneficial.\n- The evaluation spans distinct generative paradigms, and the method shows consistent gains across them, indicating improved robustness of the learned representations.\n- The 3DGS results highlight the method’s applicability to emerging synthetic formats beyond classical image generators.", "weaknesses": "- While effective, the core contribution largely builds on established concepts such as HSIC-based information bottlenecks and CLIP feature refinement. The paper does not sufficiently articulate what is fundamentally novel beyond applying HSIC to a different backbone and combining it with a replay mechanism. As a result, the contribution may be perceived as incremental rather than conceptually innovative.\n- The paper provides qualitative intuition and t-SNE visualizations but lacks deeper analysis on what specific semantic attributes are suppressed or preserved through HSIC regularization. A more detailed investigation into feature disentanglement, representation shift, or artifact suppression would strengthen interpretability and scientific value. Without such analysis, the method may appear as a black-box regularizer rather than a principled representation intervention.\n- The experiments focus on ProGAN, SDv1.4, and 3DGS-based generators, which do not reflect the current state of generative technology, such as Stable Diffusion 3+, Midjourney, Sora 2, or FLUX models. Since newer generators produce more photorealistic and harder-to-detect outputs, evaluation on these models is essential to demonstrate real-world utility. The absence of such results weakens the strength of the claimed “generalization” capability.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "mEoARRsuzL", "reviewer": "Reviewer_BxLj", "summary": "This paper addresses two critical challenges in synthetic image detection: poor cross-generator generalization and catastrophic forgetting in domain-incremental learning. To tackle these issues, the authors propose two core components: (1) an HSIC (Hilbert-Schmidt Independence Criterion) bottleneck applied to intermediate CLIP ViT features, which suppresses text-image alignment semantics (irrelevant to authenticity) while enhancing discriminative representations for real vs. synthetic images; (2) HSIC-Guided Replay (HGR), a rehearsal strategy that selects per-class exemplars via a hybrid score combining HSIC relevance (information centrality) and k-center coverage (spatial diversity), mitigating forgetting during domain adaptation. Additionally, the authors curate a 3D Gaussian Splatting (3DGS) head avatar benchmark dataset, covering multi-view reconstruction, single-view reconstruction, and generative pipelines, to support domain-incremental evaluation. Empirical evaluations are conducted in two phases: Phase I tests cross-generator transfer between diffusion and GAN models, and Phase II assesses sequential adaptation to 3DGS domains. Results show the HSIC bottleneck improves cross-generator generalization, while HGR sustains prior-domain accuracy during 3DGS adaptation. The paper's main contributions include the HSIC bottleneck design, the HGR rehearsal mechanism, and the 3DGS benchmark dataset.", "questions": "**To facilitate discussions during the Rebuttal phase, authors are advised to respond point-by-point (indicating the question number).**\n\n(1) Could you provide the following critical implementation details to ensure reproducibility? (a) The exact architecture of the HSIC bottleneck's projection layer (e.g., number of fully connected layers, activation functions, output dimension); (b) Full training hyperparameters (batch size, number of epochs, weight decay, learning rate scheduler, optimizer momentum); (c) Specific data preprocessing steps (image resolution, normalization parameters, face cropping logic for 3DGS avatars); (d) Code for HSIC calculation (e.g., Gaussian RBF kernel bandwidth calculation via median heuristic, Gram matrix centering implementation).  \n\n(2) (a) Could you provide a formal analysis of the HSIC bottleneck's convergence (e.g., proof of loss monotonicity or bounds on generalization error)? (b) How do you quantitatively verify that the HSIC bottleneck suppresses text-alignment semantics? For example, using cosine similarity between CLIP features and text embeddings (e.g., \"face\" captions) before/after applying the bottleneck. (c) Could you provide a theoretical justification for combining HSIC relevance and k-center coverage in HGR (e.g., a bound on the expected error reduction compared to single-criterion selection)?  \n\n(3) (a) Did you use official implementations and default hyperparameters for baselines (e.g., UniFD, NPR, VIB-Net)? If not, what modifications were made, and why? (b) Could you add comparisons with 2025-post synthetic image detection methods (e.g., any new diffusion-specific detectors or 3DGS detection methods)? (c) Could you provide computational efficiency metrics (inference time per image, training memory usage) for your method and baselines on the same hardware (e.g., NVIDIA RTX 4090)?  \n\n(4) (a) Could you fill in the missing cells in Tables 1 and 2 and clarify dataset labels for all columns? (b) Could you add quantitative clustering metrics (silhouette coefficient, Davies-Bouldin index) for t-SNE visualizations (Figures 2, 6, 7) to quantify real/synthetic separation? (c) Could you provide standard deviations and 95% confidence intervals for all reported mean accuracy/mAP values, along with the number of independent runs (e.g., 5 runs)?  \n\n(5) (a) Could you conduct a sensitivity analysis of HSIC's λx and λy (e.g., λx=300, 700, 1100; λy=500, 700, 900) for SDV1.4 and ProGAN, and plot performance trends? (b) Could you test multiple values of HGR's λkc (e.g., 0.1, 0.5, 1.0, 2.0) and analyze how it impacts exemplar selection and domain-incremental performance? (c) Could you explain the rationale for choosing keep_frac=0.01 and test keep_frac=0.005, 0.02 to show memory-size impact?  \n\n(6) (a) Could you extend the domain-incremental evaluation to include non-3DGS domains (e.g., NeRF-rendered images, SDv3-generated images) to test HGR's generalizability? (b) Could you evaluate long-sequence adaptation (e.g., 5+ domains) and report cumulative forgetting curves? (c) Could you quantify backward transfer (using the formula: Backward Transfer = (Accuracy after new domain - Accuracy before new domain) / Accuracy before new domain) for all prior domains?  \n\n(7) (a) Could you evaluate detection performance on low-resolution synthetic images (32×32, 64×64) and post-processed images (JPEG compression: quality 20, 50; Gaussian blur: σ=1, 3)? (b) Could you test adversarial robustness using FGSM/PGD attacks (ε=0.01, 0.03) and report accuracy degradation? (c) Could you test performance on imbalanced real/synthetic splits (1:5, 1:10) and compare against rebalancing strategies (e.g., class weights)?  \n\n(8) (a) Could you test the HSIC bottleneck on lighter backbones (MobileNetV3, EfficientNet-B0) and report performance vs. efficiency trade-offs? (b) Could you extend the method to multi-modal data (e.g., synthetic images with text overlays) by fusing text and image features in the HSIC bottleneck? (c) Could you provide ablation results for CLIP layer selection (e.g., only late layers, only middle layers) to identify the most critical layers for detection?  \n\n(9) (a) What are the main limitations of the HSIC bottleneck in practical deployment (e.g., computational cost, backbone dependence)? How do you plan to address them in future work? (b) How does the method perform when synthetic images are designed to mimic real-image statistics (e.g., adversarial synthetic images)? (c) Could you discuss scenarios where the method fails (e.g., specific generators, image types) and provide failure case examples?  \n\n(10) (a) Could you explain the \"identity-disjoint split\" implementation for the 3DGS dataset (e.g., how identities were labeled, tools used for identity verification)? (b) Could you provide the exact sample counts for each sub-dataset in the GAN/diffusion evaluation (e.g., ProGAN: 10k samples, SDV1.4: 15k samples)? (c) Could you release the 3DGS dataset (or a sample subset) and provide access links to facilitate further research?  \n\n(11) (a) Could you quantify the training time overhead of the HSIC bottleneck compared to a standard CLIP linear probe (e.g., % increase in epochs per hour)? (b) Could you propose optimizations for HSIC calculation (e.g., batch-wise Gram matrix computation) to reduce overhead?  \n\n(12) (a) Could you compare HGR's forward transfer (performance on new domains) with baselines (iCaRL, CBRS) using quantitative forward transfer metrics? (b) Could you analyze why HGR performs better on SA than GAGAvatar in Table 4? Are there domain-specific artifacts that HGR captures more effectively?  \n\n(13) (a) Could you test alternative feature aggregation methods (e.g., attention-based fusion, average pooling) for CLIP intermediate layers and compare performance with concatenation? (b) Could you provide a dimensionality analysis of the concatenated features (24 intermediate + 1 final layer) and explain how you avoid overfitting due to high dimensionality?  \n\n(14) (a) Could you discuss the method's potential deployment scenarios (e.g., social media content moderation, forensics) and any practical challenges (e.g., real-time inference, scalability)? (b) Could you test the method on a real-world dataset (e.g., Reddit synthetic image subsets) with uncurated synthetic/real images?  \n\n(15) (a) Could you conduct a direct comparison of the HSIC bottleneck and VIB-Net's variational bottleneck (e.g., performance on the same test sets, computational cost, robustness to noise)? (b) Could you explain why the HSIC bottleneck is more effective at suppressing text-alignment semantics than VIB?", "limitations": "", "rating": 4, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "(1) The HSIC bottleneck innovatively leverages intermediate CLIP features to resolve the interference of text-image alignment semantics (a key limitation of CLIP-based detectors), and its combination with information-theoretic regularization (minimizing input dependence, maximizing label dependence) is theoretically grounded and practically effective.  \n\n(2) HGR addresses the inefficiency of traditional replay methods by fusing HSIC relevance (ensuring exemplar informativeness) and k-center coverage (ensuring diversity), achieving compact memory usage while mitigating forgetting--filling a gap in domain-incremental synthetic image detection.  \n\n(3) The 3DGS head avatar dataset (with identity-disjoint splits and standardized preprocessing) addresses the lack of benchmarks for rendered synthetic images, supporting research on domain-incremental adaptation to 3D-generated content.  \n\n(4) The two-phase evaluation (cross-generator generalization + domain-incremental learning) covers diverse scenarios (diffusion, GAN, 3DGS). The authors compare against 6+ baselines (e.g., CNNSpot, LGrad, UniFD, iCaRL) and conduct detailed ablations (HSIC components, kernel choices, intermediate features), verifying the necessity of each module.  \n\n(5) Ablation studies confirm the role of HSIC(x,z) (suppressing input shortcuts) and HSIC(y,z) (aligning with labels), while t-SNE visualizations qualitatively demonstrate that the HSIC bottleneck reshapes features into more separable real/synthetic clusters--strengthening the credibility of the proposed method.", "weaknesses": "(1) The paper lacks critical implementation specifics. For example, regarding the HSIC bottleneck: the authors mention a \"64-D projection\" but do not specify the projection layer's structure (e.g., fully connected layer with activation function? Number of neurons in hidden layers, if any?). For training parameters: the learning rate is set to \\(10^{-4}\\) (SGD), but no details are provided on batch size, number of training epochs, weight decay, or learning rate scheduling (e.g., step decay, cosine annealing)--parameters that directly impact model convergence and performance. For data preprocessing: while \"standardized preprocessing\" is mentioned for the 3DGS dataset, there is no description of specific steps (e.g., image resizing resolution, normalization mean/std values, whether face cropping is applied for head avatars). Without these details, other researchers cannot replicate the experiments, violating the reproducibility principles of academic research.  \n\n(2) The paper's theoretical foundation for the HSIC bottleneck and HGR is insufficient. For the HSIC bottleneck: Equation (6) defines the loss function, but the authors do not analyze its convergence properties (e.g., whether the loss decreases monotonically during training, or under what conditions the model converges to a global optimum). There is also no discussion of why minimizing HSIC(x,z) (input-feature dependence) effectively suppresses text-alignment semantics--only qualitative t-SNE results are provided, lacking quantitative evidence (e.g., semantic similarity scores between features and text captions before/after applying the bottleneck). For HGR: the authors claim the hybrid score (HSIC relevance + k-center coverage) improves exemplar selection, but there is no theoretical justification for why this combination outperforms single-criterion methods (e.g., pure HSIC or pure k-center). For instance, no proof is given that HSIC relevance correlates with exemplar informativeness, or that k-center coverage effectively reduces redundancy. This weakens the method's theoretical rigor.  \n\n(3) The evaluation is limited to specific scenarios, failing to test the method's robustness across broader conditions. First, **dataset scope limitation**: The 3DGS benchmark only focuses on head avatars, with no evaluation on 3D-generated non-face scenes (e.g., 3DGS-rendered landscapes, objects). This raises questions about whether the method generalizes to other 3D-rendered content. Second, **synthetic image diversity limitation**: Cross-generator evaluation only includes classic diffusion models (e.g., SDV1.4, ADM) and GANs (e.g., ProGAN, StyleGAN), but not recent variants (e.g., Stable Diffusion 3, GANformer) or hybrid models (e.g., diffusion-GAN hybrids). Third, **image quality robustness**: There is no evaluation of detection performance on low-resolution synthetic images (e.g., 32×32, 64×64) or images subjected to post-processing (e.g., JPEG compression, Gaussian blur, rotation)--common in real-world scenarios. Fourth, **adversarial robustness**: The paper does not test whether the method retains performance under adversarial attacks (e.g., FGSM, PGD attacks on synthetic images to evade detection), a critical consideration for practical deployment.  \n\n(4) While the paper compares against multiple baselines, several critical comparisons are missing or insufficient. First, **latest method omissions**: The paper cites baselines up to 2025 (e.g., VIB-Net, 2025) but does not compare against any 2025-post methods (e.g., diffusion-specific detectors or 3DGS-focused detection methods) that may have addressed similar problems. Second, **unclear baseline parameter consistency**: For baselines like UniFD and NPR, the authors do not confirm whether they used the official implementations or default parameters--if the baselines were not optimized (e.g., using suboptimal hyperparameters), the comparison results may overstate the proposed method's advantages. Third, **incomplete cross-method ablation**: For example, when comparing HGR with iCaRL and CBRS, the paper does not conduct ablation studies on combining HGR with other rehearsal strategies (e.g., iCaRL's class-mean herding) to test for synergies. Fourth, **computational efficiency comparison**: No comparison of inference time or training memory usage between the proposed method and baselines is provided--critical for practical deployment (e.g., on edge devices).  \n\n(5) Key results are presented unclearly or incompletely, hindering result verification. First, **table data gaps**: Tables 1 and 2 (cross-generator generalization results) contain empty cells (e.g., Table 1's \"| 61.61/83.59 60.74/90.24 48.82/47.51 61.43/82.74 | 58.65/51.77 60.30/83.30 89.70/96.59 97.54/99.64 99.49/99.99 88.60/98.44 | | | |\") and missing dataset labels for some columns, making it impossible to determine which targets the results correspond to. Second, **lack of quantitative clustering analysis**: While t-SNE visualizations (Figures 2, 6, 7) show qualitative improvements in real/synthetic separation, no quantitative metrics (e.g., silhouette coefficient, Davies-Bouldin index, or inter/intra-cluster distance ratios) are provided to measure clustering quality--weakening the evidence for feature reshaping. Third, **insufficient statistical significance**: Most results report mean accuracy/mAP but lack standard deviations (except in Figure 3) or confidence intervals. For example, Table 3 and 4 (domain-incremental results) do not specify how many runs were averaged, or whether differences between methods are statistically significant (e.g., via t-tests). Fourth, **parameter sensitivity analysis gaps**: The HSIC bottleneck uses λx=900/500 and λy=700/600 for SDV1.4/ProGAN training, but no sensitivity analysis is provided (e.g., how performance changes when λx/λy varies by ±20%, ±50%). Similarly, HGR's λkc (controlling k-center weight) only tests \"λkc=0\" and \"larger values\"--no gradient-based analysis of optimal λkc for different datasets.  \n\n(6) The domain-incremental phase only evaluates adaptation to 3DGS domains, with several limitations. First, **limited domain diversity**: No adaptation to other emerging synthetic domains (e.g., text-to-video frame extracts, neural radiance field (NeRF)-rendered images) is tested, raising questions about HGR's generalizability to non-3DGS domains. Second, **short adaptation sequence**: Only 3 3DGS sub-domains are used (GHA, SA, GAGAvatar)--no evaluation of long-sequence adaptation (e.g., 5+ domains) to test cumulative forgetting. Third, **fixed memory budget**: The paper uses a fixed keep_frac=0.01 (1% of training samples) for the replay buffer but does not test how memory size impacts performance (e.g., keep_frac=0.005, 0.02) or compare against dynamic memory allocation strategies. Fourth, **no backward transfer analysis**: Backward transfer (improvement in prior-domain performance after adapting to new domains) is a key metric for continual learning, but the paper only reports \"preserving prior accuracy\" without quantifying backward transfer--failing to fully demonstrate HGR's advantages over baselines.  \n\n(7) The paper does not acknowledge or discuss the proposed method's inherent limitations. First, **backbone dependence**: The method relies on CLIP ViT features, but no analysis is provided of performance degradation when using lighter backbones (e.g., MobileNet, EfficientNet) for edge deployment. Second, **data imbalance impact**: The 3DGS dataset uses balanced real/synthetic splits (e.g., GHA: 45,772 real / 45,772 synthetic), but no test of imbalanced splits (e.g., 1:10 real:synthetic) is conducted--common in real-world scenarios where synthetic images may be more abundant. Third, **modal limitation**: Only single-image detection is supported, with no extension to multi-modal synthetic data (e.g., synthetic images with text overlays, audio-synced synthetic video frames). Fourth, **computational overhead of HSIC**: HSIC calculation requires Gram matrix construction and centering, which increases computational complexity--no quantification of training/inference time overhead compared to non-HSIC methods (e.g., how much slower the HSIC bottleneck is than a standard CLIP linear probe).  \n\n(8) The related work section has gaps and superficial comparisons. First, **HSIC application gaps**: The paper cites HSIC (Gretton et al., 2005) but does not discuss recent HSIC applications in computer vision (e.g., HSIC for domain adaptation, few-shot learning) or compare how its HSIC bottleneck differs from existing HSIC-based feature regularization methods. Second, **continual learning omissions**: Key rehearsal-based methods (e.g., Memory Replay GANs, Contrastive Replay) are not cited, and no discussion of how HGR differs from contrastive exemplar selection methods is provided. Third, **3DGS detection gaps**: No discussion of existing 3DGS/rendered image detection methods (if any) is provided--failing to position the paper's 3DGS benchmark within the broader literature. Fourth, **superficial baseline analysis**: For baselines like VIB-Net (2025), the paper only states it \"uses a variational information bottleneck\" but does not compare the HSIC bottleneck (information-theoretic) with VIB (probabilistic) in terms of theoretical framework or performance--missing an opportunity to highlight the HSIC bottleneck's advantages.  \n\n(9) The paper states the HSIC bottleneck \"concatenates features from 24 intermediate CLIP ViT layers and the final layer\" but provides no details on aggregation. First, **layer selection rationale**: No explanation is given for choosing 24 intermediate layers (e.g., why not 12, 36 layers?) or which specific layers (e.g., early, middle, late) are selected. Second, **aggregation method**: Concatenation may lead to high dimensionality (e.g., 25 layers × 768 dim (ViT-B) = 19,200 dim), but no dimensionality reduction (e.g., PCA, t-SNE) or feature fusion (e.g., attention-based fusion) is mentioned--raising questions about computational efficiency and redundancy. Third, **layer-wise contribution**: No ablation of individual layer contributions (e.g., removing early layers) is conducted--failing to identify which layers are most critical for detection.  \n\n(10) Qualitative results (e.g., t-SNE, sample images) are not fully analyzed. First, **t-SNE interpretation gaps**: Figures 6 and 7 (t-SNE of CLIP vs. HSIC features) show \"tighter clusters\" but do not explain why some datasets (e.g., GauGAN in Figure 7) still have overlapping clusters--failing to address the method's limitations for specific generators. Second, **no failure case analysis**: No discussion of misclassified samples (e.g., why some real images are mislabeled as synthetic) or analysis of common artifacts in misclassified synthetic images--critical for guiding future improvements. Third, **3DGS sample visualization**: The paper mentions Figure 1 (3DGS sample images) but does not provide qualitative comparisons of detection performance across 3DGS sub-domains (e.g., why SA has higher accuracy than GAGAvatar)--missing insights into domain-specific challenges.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "TJh5602Xei", "reviewer": "Reviewer_91jn", "summary": "Authors propose a new bottleneck loss for synthetic image detection, based on HSIC. The method computes the Hilbert-Schmidt Independence Criterion (HSIC) on the image and label encoded embeddings, and add that to the binary-cross entropy loss already used. For the domain-incremental setting, HSIC is used to guide replay. The work includes experiments comparing on cross-generator generalization and continual adaptation, as well as an ablation on the HSIC components and an analysis of the domain-incremental learning.", "questions": "None at this time", "limitations": "", "rating": 2, "confidence": 4, "soundness": 1, "presentation": 3, "contribution": 2, "strengths": "S1) The intuition portions of the paper are fairly easy to read.\n\nS2) The t-SNE plots are nice included analysis.\n\nS3) The method seems mathematically well-grounded.", "weaknesses": "W1) In the DIL setting, the comparison methods are out-of-date (the newest being from 2020). This makes it unclear how the presented method compares with SOTA.\n\nW2) In the cross-generator generalization setting, the chosen models are also out-of-date (the newest being from 2022). It would be much more relevant to test on the SOTA generative models being used today, to understand how applicable this method is in practice (e.g. FLUX, Qwen-Image, etc).\n\nW3) The related work section is also not in-depth enough and out-dated in some places, making it difficult to place the work within contemporary literature. For example, in section 2.2. (Continual Learning related works), the newest method is from 2021, while much newer work exists, e.g. [A].\n\nW4) The mathematical background section (2.3) misses explicitly defining some mathematical notation (variables and functions), which would be useful for improving the clarity for readers. Most notably 1, but also e.g. tr and I would be useful, for completeness.\n\nW5) An ablation over the choice of replay would be useful in understanding its role, given it is part of the proposed methodology.\n\n[A] Boosting Domain Incremental Learning: Selecting the Optimal Parameters is All You Need, Wang et al., CVPR 2025.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "02B3FfvoR3", "reviewer": "Reviewer_zYvc", "summary": "The paper introduces a new synthetic image detector with contributions to the model architecture, adaptations to continual learning and a new synthetic image benchmark that contains 3D Gaussian Splatting (3DGS) rendered images. The evaluation is twofold, including both a binary supervised detection task and its continual learning variant with a HSIC-Guided Replay (HGR) adaptation. The proposed model achieves state-of-the-art performance in cross-generator evaluation, generalizing between diffusion-based and GAN-based images, with an improvement of over 5 percentage points. Moreover, it demonstrates strong continual learning capability when incrementally trained to detect 3DGS-generated images.", "questions": "- What’s the difference between your method (refferred to as Ours in Table 1 and 2) and DualHSIC with a CLIP backbone?\n - What architecture does the classifier (g_{\\theta_g}) has? \n - From where do real samples from the 3DGS datasets come from?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 2, "strengths": "- The method achieves state-of-the-art performances, especially in the cross-generators evaluation setup. Furthermore, results in the continual learning setup improve over the single-dataset training baseline and, in some cases, even surpass those obtained by jointly training on the additional 3DGS datasets.\n - The inclusion of a 3DGS benchmark is a valuable addition, introducing a new family of synthetic image generation methods  beyond GANs and diffusion models which have dominated the detection research.\n - The paper reinforces the effective use of HSIC in both supervised and continual learning setups.", "weaknesses": "- The HSIC bottleneck is not entirely novel; it can be seen as a combination of the RINE[1] and DualHSIC[2] approaches.\nRINE’s performance is missing from Table 1, which could potentially narrow the gap between the current model and the top-performing prior works reported in the same table.\n - The performance gains of the HSIC term in HGR is uncertain. Ablation on the performance gains due to inclusion of \\( 1 - \\mathcal{N}(r_i) \\) term in Equation 10 would help justify its contribution to the overall performance and clarify its impact.\nTypo: In Table 5 b) The Cosine kernel achieves highest mACC on ProGAN and should be bolded instead of median version of RBF.\n - While the paper improves performance on the GenImage benchmark, the core method relies heavily on existing approaches and therefore provides limited new contributions to the synthetic image detection community. However, the inclusion of 3DGS samples in the continual learning setup represents a significant strength supporting acceptance. To further strengthen the paper, the authors should better motivate the method’s novelty and its relevance to the community. Additionally, a useful way to justify the method’s performance would be to compare its cross-generator performance on 3DGS with previous methods (using the base method results from Tables 3 and 4, which show a significant gap between 3DGS and Diffusion or GAN generators).\n\n\n[1] Christos Koutlis and Symeon Papadopoulos. “Leveraging representations from intermediate encoder-blocks for synthetic image detection.” ECCV 2024\n\n[2] Zifeng Wang, Zheng Zhan, Yifan Gong, Yucai Shao, Stratis Ioannidis, Yanzhi Wang, and Jennifer Dy. “DualHSIC: HSIC-bottleneck and alignment for continual learning.” ICML 2023", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)