Enabling Your Forensic Detector Know ​How Well​ It Performs on Distorted Samples
Authors: Bin Li
Haoyu Li
Haodong Li
Jiaming Zhong
Changsheng Chen
Jiangqun Ni
bo.cao
Venue: ICLR 2026 Poster (2026)
Keywords: image distortions
forensics
quality
confidence
Primary area: applications to computer vision, audio, language, and other modalities

Abstract: Generative AI has substantially facilitated realistic image synthesizing, posing great challenges for reliable forensics. When image forensic detectors are deployed in the wild, the inputs usually undergone various distortions including compression, rescaling, and lossy transmission. Such distortions severely erode forensic traces and make a detector fail silently—returning an over-confident binary prediction while being incapable of making reliable decision, as the detector cannot explicitly perceive the degree of data distortion. This paper argues that reliable forensics must therefore move beyond "is the image real or fake?" to also ask "how trustworthy is the detector's decision on the image?" We formulate this requirement as Detector's Distortion-Aware Confidence (DAC): a sample-level confidence that a given detector could properly handle the input. Taking AI-generated image detection as an example, we empirically discover that detection accuracy drops almost monotonically with full-reference image quality scores as distortion becomes severer, while such references are in fact unavailable at test time. Guided by this observation, the Distortion-Aware Confidence Model (DACOM) is proposed as a useful assistant to the forensic detector. DACOM utilizes full-reference image quality assessment to provide oracle statistical information that labels the detectability of images for training, and integrates intermediate forensic features of the detector, no-reference image quality descriptors and distortion-type cues to estimate DAC. With the estimated confidence score, it is possible to conduct selective abstention and multi-detector routing to improve the overall accuracy of a detection system. Extensive experiments have demonstrated the effectiveness of our approach.

Published as a conference paper at ICLR 2026
ENABLING YOUR FORENSIC DETECTOR KNOW How WELL IT PERFORMS ON DISTORTED SAMPLES
Bin Li,, Haoyu Lii, Haodong Li Jiaming Zhong! Changsheng Chen², Jiangqun Ni Bo Cao
'Guangdong Provincial Key Laboratory of Intelligent Information Processing and Shenzhen Key Laboratory of Media Security, Shenzhen University
Faaulty of Engineering, Shenzhen MSU-BIT University SSUN YAT-SEN University "The Smart City Research Institute of China Electronics Technology Group Corporation
ABSTRACT
Generative AI has substantially facilitated realistic image synthesizing, posing great challenges for reliable forensics. When image forensic detectors are de- ployed in the wild, the inputs usually undergone various distortions including compression, rescaling, and lossy transmission. Such distortions severely erode forensic traces and make a detector fail silently-reuuminn nary prediction while being incapable of making reliable decision, as the detector cannot explicitly perceive the degree of data distortion. This paper argues that reli- able forensics must therefore move beyond "is the image real or fake?" to also ask "how trustworthy the detector's decision on the image?" We formulate this re- quirement as Detector's Distortion-Awes Confidence (DAC): sample-level con- fidence that a given detector could properly handle the input. Taking Al-generated image detection an example, empirically discover that detection accuracy drops almost monotonically with full-reference image quality scores as distortion becomes severer, while such references are in fact unavailable at test time. Guided by this observation, the Distortion-A Aware Confidence Model (DACOM) is pro- posed useful assistant the forensic detector. DACOM utilizes full-reference image quality assessment to provide oracle statistical information that labels the detectability of images for training, and integrates intermediate forensic features of the detector, no-reference image quality descriptors and distortion-type cues to estimate DAC. With the estimated confidence score, it is possible conduct se- lective abstention and multi-detector routing improve the overall accuracy of a detection system. Extensive experiments have demonstrated the effectiveness our approach.
an over-confident bi-
INTRODUCTION
With the rapid development of generative artificial intelligence (e.g., GANs (Goodfellow al. 2014) and Diffusion Models (Ho et al.) (020)). photo-realistic contents can be manipulated or synthesized scale. To defense against such fake visual contents, image forensics increasingly underpin safety- critical decisions. However, great challenges are presented in the practical deployment of forensic detectors. Most images have already undergone various degradations, such compression, resam- pling, lossy platform transmission, and so on. Such distortions which may not be well-informed can weaken forensic traces and often push an input beyond the detector's "comfort zone". Unfortunately, if a detector is trained exclusively on clean data, it remains largely unaware of distortions; conse- quently, as shown in Figure T (a), it reports only binary decision (real fake) without quantifying how much the decision should be trusted. Lacking this confidence signal, downstream systems (e.g., human fact-checkers, multi-detector pools) cannot assess which detector performs better on a certain sample, and thus are unable reasonably abstain select among detectors, raising both reliability and usability concerns. Even when distortion augmentations are included during training, this issue still persists. Consequently, argue that confidence matters in reliable image forensics.
"Corresoonding Author

---

Published as a conference paper at ICLR 2026
To tackle the above challenges, several intuitive strategies could be employed in practice, yet they suffer from clear limitations. Robustness training seeks model that works under distortions, but the combinatorial explosion of dis- tortion type/degree makes it elusive and computationally costly. Confidence calibration (Guo et al. (017)) can improve probability estimates in standard classification, but distortion shifts the input distribution heterogeneously and thus breaks the calibration assumptions. Using image quality (assessed without reference) as proxy for distor- tion level is potential to estimate forensic performance, as shown in prior study (Kim et al., 2024). However, com- mon no-reference image quality assessment (NR-IQA) is
dutartiona
Detector
logit:0.79 79 Fake
Aedien
more reliable?
Opee world
Detector
logit:0.22 Real
(a)Existing (b)Ours 1ogit:0.79 Fiske
Detector
Resion
DACOM
confielence-0016 16
More reliablet
Detector
logit:0.21 Real
JPEG
Openwarld
confidencee00.89
designed for human perception and cannot directly reflect the detection confidence (refer to Section 3). Another line of work examines forensicability (Chu al., 2015] Pasquini & Böhme 2018)-the intrinsic detectability de- termined by the data distribution. However, such treat- ments do not bridge detectability of data with specific de- tector, leaving a gap in practical application. Therefore, we propose constructing Distortion Confidence (DAC) score, a
Figure I: When facing open-world dis- tortions, detectors' outputs lack relia- bility. The proposed Distortion-Ar Confidence Model (DACOM) provides sample-level confidence scores to facil- itate reliable detection.
score that estimates the probability that a given image will classified correctly under its present distor- tions.
In this paper, we take Al-generated image (AIGI) detection as a case study to analyze how distor- tion affects forensic performance and how to link image quality with DAC. Our analysis reveals that, when a pristine reference is available, full-reference image quality assessment (FR-IQA) pro- duces scores that line up almost monotonically with detector accuracy across all tested distortions, suggesting that forensic confidence can be obtained with the guidance of image quality. The gaps for practical applications lie in: (i) Image quality must be estimated without reference test time. While NR-IQA is available, it is too noisy to serve as a direct surrogate. (ii) Our analysis shows that different types of distortions lead to different degrees of detection confidence, even when the resulting FR-IQA score is the same. It indicates that we need to build a more sophisticated and generalizable model bridge image quality, distortion type, and forensic performance, as to effectively estimate DAC which can be served as an useful indicator for either human decision or expert system fusion.
Building on the above insights, this paper proposes to develop a Distortion-Awars Confidence Model (DACOM). The key idea is to distill the reliable relationship observed with FR-IQA into a trainable confidence model, eliminating the need for references at test time. DACOM fuses forensic features derived from the detector, no-reference image quality descriptors, and distortion-type cues to pro- duce confidence scores. During training, for each distortion type, we record the detector's empirical accuracy at different levels of image quality by using FR-IQA as an oracle, and treat the correspond- ing accuracy image label explicitly linking distortion degree to forensic performance. A regressor is trained to map the features to the obtained labels. Once trained, DACOM outputs a confidence score per image (Figure (b)). which can be attached legacy detectors or an ensemble of de- tectors, enabling abstention policies and multi-detector routing. Our contributions are summarized as follows:
We formulate DAC, providing principled reliability target for practical forensics. On this basis, we conduct an in-depth analysis and reveal the relationship between FR-IQA scores and forensic accuracy, offering the empirical foundation for confidence modelling.
We introduce DACOM to connect image quality with detection confidence. It uses super- vision guided by FR-IQA during training, yet at inference it estimates sample-level DAC scores without reference. DACOM can be deployed with diverse forensic detectors.
Extensive experiments on multiple datasets, detectors, and distortion types shows that DA- COM can effectively predict confidence and unlock advantages in downstream tasks, in- cluding a 7.66% relative accuracy improvement via selective filtering and a 5.84% accuracy improvement in multi-detector routing compared with naive logit calibration.
2

---

Published as a conference paper at ICLR 2026
Prote
03
Kerao Colern
CAR
(a) DISTS with CD
(b) SSSM witM ND
MS-SSIM with C2P
Peazy Color Ag.
hote
Coly Ag
04
fecos Colern
10:00000
10108 (0:0240
15:00
484
(d) QualiCLIP with CD
ARNIQA with ND
QualiCLIP with C2P
Figure 2: Relationship between IQA Metries and Model Detection Performance. (a)-(c) show the relationship between FR-IQA scores and model balanced accuracy; (d)-(f) show the corresponding relationship for NR-IQA metrics.
2 RELATED WORKS
Robust AIGI Detection. Early CNN-based detectors focused on spatial features and employed data augmentation (e.g., JPEG compression, blurring) (Wang et al.) 2020 Gragnaniello et al.) 2021 to gain robustness against common distortions, but they generalized poorly unseen processing. Later
methods exploited frequency features (Tan et al., 2024a 2023 Li et al. 2024b; Tan et al. 2024b), handcrafted extractors (Li al. (024a) to enhance subtle forensic cues and improve generalization. Yet, frequency-domal domain information is highly eestortion-sensitiie
where even slight perturbations can cause sharp performance drops. Some approaches (Tao et al., (2025) improved robustness to JPEG and OSN (Online Social Networks) distortions by adding paired original-compressed samples during training. More recently, reconstruction-base methods use diffusion models to recover au- thentic counterparts, where latent-space reconstruction (Chen et al. (024a) yields greater robustness than pixel-space (Wang et al., 2023) under the same augmentations. While these methods improve robustness, they seldom address the reliability of predictions under diverse distortions. In contrast, our work focuses on quantifying reliability by linking distortion intensity to detection performance.
Model Self- Self-Assessment and Forensibility. Many methods have been proposed for uncertainty esti- mation (Blundell et al. 2015 Gal & Ghahramani [2016] Lakshminarayanan et al.. [017] Van Amers- [ Nacini al.) 2015).. but they are mostly designed for general tasks and have not been systematically adapted to image forensics. Recently, several studies (Zhang et al. 2025 Ji ei al. 2023 Lin et 2024 Hao et al. 2024 Pan al. 2024)
foort al. [202] 20200) Guo et al. [0017 Liang et al. 2017]
have introduced uncertainty mode ing into forensics, yet typically as means to boost model perfor- mance or robustness. rather than as a principled quantification of detection reliability. In addition, the inffommttion-therree notion of forensicability (Chu et al. 2015 Pasquini & Böhme, [2018] Chen al. 2022 Pasquini & Böhme 2017] Schlögl et al.] 2021 Li al. 2023) provides valuable insights into the theoretical limits of forensic systems. However, its application has largely remained a the- oretical level, with limited validation under realistic conditions, leading to gap between theoretical potential and practical effectiveness.
ANALYSIS OF FORENSIC PERFORMANCE: A DISTORTION PERSPECTIVE
Before introducing our confidence model, we first present an analysis of forensic performance from a distortion perspective, establishing the empirical foundation for our framework. Specifically, we aim to answer two questions:
(i) How do common distortions affect the accuracy of forensic detectors?
(ii) Can off-the-shelf Image Quality Assessment (IQA) metries serve as proxies for esti- mating the detection confidence on a given image?
3

---

Published as a conference paper at ICLR 2026
Setup of Analysis. We adopt three pretrained AIGI detectors (CD, ND, and C2P"; details pro- vided in Section 5.11 and six common distortion types (additional results for more distortion types is provided in Appendix Figure [6) in our empirical analysis. For every distorted image. we employ image quality assessment (IQA) methods to quantify the degree of distortion. Specifically, we com- pute FR-IQA DISTS (Ding et al. 2020), SSIM (Hore & Ziou 2010), and MS-SSIM (Sara) et al.] 2024b), QualiCLIP (Agnolueci al. 2024a), etc. We then bucket images by quality score and mea- sure balanced accuracy in each bucket, thereby obtaining the forensic performance of each detector on images subjected to certain type and a certain degree of distortion. The obtained results are shown in Figure 2
the pristine reference, as well as NR-IQA scores- ARNIQA (Agnolucci et al.,
FR-IQA strongly correlates with detection performance. A clear positive correlation between FR-IQA metrics and the performance of different detectors is observed in Figure2((a)(C)) for fixed distortion type, a more severe degradation (i.e., a lower FR-IQA score) results in poorer detection performance. This suggests that FR-IQA can reliably characterize the relation between distortion intensity and performance degradation under a given distortion type. Moreover, we observe that the more severe FR-IQA degradation, the greater shifts in the logit distribution (Appendix B Therefore, we conclude that FR-IQA captures an oracle notion of distortion severity that is strongly predictive of forensic performance. We should also note that FR-IQA methods cannol be applied inference time as they require access to the reference images.
NR-IQA alone is insufficient to predict detection performance. In contrast to FR-IQA, the cor- relation between NR-IQA metrics and detection performance is relatively weak. As shown in Fig- ure (d)- the NR-IQA scores fail exhibit consistent trend of "lower quality leads to lower performance". This is primarily because NR-IQA metrics are designed based on human perceptual quality, which highly content-dependent and thus difficult to be directly applied predicting the behavior of forensic models. These observations indicate that while NR-IQA methods are deployable and can perceive degradation, their scores exhibit a weak and inconsistent correlation with forensic performance, making them unsuitable to be used alone as reliable indicator of model confidence.
Distortion type a critical factor. As shown in Figure 2 even at the same level of distortion, different distortion types lead to noticeably different accuracies, no matter FR-IQA or NR-IQA is used. This implies that distortion type is an indispensable factor for assessing basessinngoreesiii performance.
The above findings confirm that both the distortion type and its severity determine forensic per- formance. While FR-IQA provides a dependable signal, it is inherently seference-dependens At test time, only NR-IQA scores and detector-interit features are available, and either source alone is insufficient to predict detection confidence. These observations motivate a reference-free, distortion- aware confidence model that (i) learns to distill the relationship between FR-IQA scores and detec- tion performance during training, and (ii) fuses detector features with cues of distortion type and severity inference. The proposed model is described in the next section.
4 METHODOL.OGY
In this section, we first formalize the goal of Distortion-Awan Confidence (DAC), then detail a two- stage pipeline that (i) converts full-reference image quality statistics into per-image reliability labels and (ii) trains a reference- free Distortion-Awar Confidence Model (DACOM) that can be plugged into a given detector.
4.1 PROBLEM FORMULATION
Consider an image forensic detector M : x E xxx +C {0, 1} trained in the standard binary-clasiffcationn paradigm. A real-world test image is typically subjected to an (unknown) distortion operation characcterreeee by its type TET and severity to a pristine image Fp. (t.a As distortion attenuates forensic traces, the softmax logit value of detector M on x is no longer a trustworthy indicator of correctness. Our target thus is to obtain a DAC score, which is defined as the sample-level probability that M is correct:
(A) = Pr(M(=)== = x:) [0,1]. 1].
4

---

Published as a conference paper at ICLR 2026
Distortion Datoset
(a) Severity Binning Assignment
Distortion Dataset
JPEG
0,67
0.49
JPEG
Detector
Blur
0.96
0.78
performance
ON
Nolse
AMA
detectubility
0.55
0.78
Detector
DACOM
Imoges
detectability
Encoder
Qusiity
Image
Projector
Conar
Detector
labels
confidence
DACOM
confidence
Ovitortion
1ypи
Projertor
Eecoder
Trainable
Frazen
Training
(b) Training DACOM
Figure 3: Overview the distortion-aware confidence pipeline. (a) illustrates the process of adaptive severity binning and data labeling, where prior knowledge of forensic performance is used to assign labels to data within each intensity bin for every distortion type. (b) depicts the training process of the DACOM. (c) shows the architecture of the DACOM.
At test time assume access the pristine reference zy and the class label c; only the image itself and intermediate features of M are available.
4.2 DISTORTION-AWAR CONFIDENCE PIPELINE
As already revealed in Sec. 3] detector accuracy varies monotonically with the FR-IQA score, and NR-IQA and detector embeddings are readily available at runtime but neither alone aligns well with detection accuracy. These observations inspire to adopt two-stage pipeline as illustrated in Fig. 3 (a)-(b). Stage A A Collect statistics and perform labeling. For every distortion type t we use FR-IQA scores (FR zo) build an ordered distortion severity axis, divide into several bins, bucket image according to bins, and record the detector's balanced accuracy as label of "detectability prior". Stage B - Train a reference-fre predictor: train DACOM, a regressor that fuses three literence-vviilbble feature streams, including detector embeddings, NR-IQA descriptors, and distortion-tyee type cues, and regresses to the detectability label obtained in Stage A. Once trained, DACOM outputs $(x; .) x= DAC (z) for given image without requiring reference images.
4.3 STAGE A: SEVERITY BINNING AND LABEL ASSIGNMENT
We construct a large-scale distorted dataset that covers multiple distortion types / E T and a range of severities. Guided by FR-IQA, we build, within each type a unified severity axis and bucket the samples along this axis. Since different distortion types exhibit distinct ranges and/or distributions of FR-IQA scores (Appendix C). naive uniform partitioning by absolute FR-IQA values causes severe imbalance across types and bins. To avoid this, we adopt type-wise adaptive binning with fixed number of bins B for every so that each distortion type contributes B buckets with comparable sample sizes.
Type-wise Adaptive Binning. Let yER be an FR-IQA metric whose larger value indicates higher quality. For each distortion type / we split its FR-IQA score distribution into B equal-frequenc, bins and collect samples into each bin as:
bin(t, b) (x f(xx t, t. 1b-1) S (1R(2, 20) qi (0) 10].b=1.... 1...B
b (b) are the B quantiless w.r.t distortion type t. Quantile where t(z) is the distortion type of x and binning guarantees similar sample counts per (t, b) and avoids the imbalance caused by the different dynamic ranges of FR-IQA metrics across types. In addition, a dedicated bin is reserved for pristine images, iee., bin(pristiin st 1).
5

---

Published as a conference paper at ICLR 2026
Bin-wise Detectability Labeling. For each bin, compute the detector's balanced accuracy samples lying in the bin:
/Ac = Acchal (M,; bin(t,
(3)
This bin-level statistic serves as a statistical average, which then converted into scalar label for representing the degree of a sample is expected to be correctly classified by M. Specifically, BAcc,,6 mapped detectability label within the range of [0, 1]:
Yt.b = 2 max (BAcc,,b - 0.5,0),
where Vt.b O means random guessing and Vr.b means perfect detection. Every sample r E bin((,), b) inherits the label y(æ) = y/,bb- These labels encode both distortion severity and type influence, providing supervised targets for Stage B.
4.4 STAGE B: CONSTRUCTING THE DISTORTION AWARE CONFIDENCE MODEL
As illustrated in Fig. 3 (c), for an image æ DACOM first extracts features with three complementary
encoders:
Forensic Trace Encoder ΦM: it extracts intermediate features from the frozen forensic detector M, carrying information about forensic traces and their corruption.
Image Quality Encoder Φ1o: it extracts Eittortion-sessiiivy features by using an NR-IQA descriptor.
Distortion Type Encoder ΦDr: it extracts embeddings of plapo which is capable of identifying various distortion types.
Features from each branch are then linearly projected a D-dimensional space (D-256):
ZM W (x),
ZiQ WIo ZDt WDI
(5)
and optionally subjected to LayerNorm. The concatenated feature vector h(x) [ZM || 2nT] R3D is fed to a MLP head ge for predicting the distortion-aware confidence:
8(x; M) = go (h(x)) [0, 1].
(6)
Training Objective. Given the bin-derived label y(x), DACOM minimises a weighted mean- squared error:
N
LMSE
Weehh, (8(#; M) )(x)))²
where W/.6 inversely scales with the bin's sample size to counter residual imbalance. Empirically, this simple loss can preserve the monotonicity FR-IQA observed in Sec. 3
Inference and Usage. At deployment, DACOM needs only the three features extracted from a given image output a(æ;; M). The output score enables: (i) selective abstention: refrain from making decisions when $(æ; M) is insufficiently high; and (ii) multi-detector selection: given mul- tiple detectors [My]. pick the one with the highest 6(x; My) for each input x. Both applications can enhance overall reliability.
5 EXPERIMENTS
5.1 EXPERIMENTAL SETTINGS
AIGI Detectors. We evaluate our confidence model on six representative AIGI detectors: CD (Wag
al. 2020), ND (Gragnaniello et al., 2021). NPR (Tan et al. 2024b), FreqNet (Tan et al. 2024a). SAFE (Li et al. 2024b) and C2P TTan et al. 2025). All models except C2P were retrained on the ForenSynths dataset using the four-class training protocol (i.e., cars, cats, chairs, and horses). Since NPR, FreqNet, and SAFE were originally trained on pristine images without robustness enhancements, incorporated two distortions augmentations during their training, i.e., JPEG

---

Published as a conference paper at ICLR 2026
CD
ND
Freghet
NPR
C2P
0.0
0.5
Confidence
Mean Confidence
Confidence
brighoness
Figure 4: Correlation between average confidence and detection accuracy. or seen distortions; A/x: unseen single/platformcoommpp compression distortions.
compression and blurring. The JPEG compression quality was sampled from [30, 100), and the blurring kernel size varied in [0, 3]. Both augmentations were applied with probability of 10%. The resulting models were denoted NPR , FreqNet. and SAFE' Unless stated otherwise, experiments conducted with the trained models CD, ND, NPR', FreqNet's SAFE'. C2P provides training code; we therefore used its released pretrained weights, denoted as C22". Mcanwhile, to validate the generality of our approach, we transfer the data domain from GANs to diffusion models. Specifically, we retrain our detector on a deffusiionmodde dataset and evaluate the proposed method under the same experimental settings. Detailed results and analyses are provided in the Appendix
Datasets. Eight distortion families were used when training DACOM, including JPEG, Blur, Noise, Resize, Color warming. Color cooling, Brighten, and Darken. Each distortion has an associated test split, forming the Seen Distortion test sets. To evaluate the generalization ability, we con- structed Unseen Distortion test sets comprising ten distortion types that never appear training- Additionally, to evaluate the screening performance, also included Evaluation-dataa and Cross-dataset. More details about datasets are provided in Appendix D
Implementation of DACOM. To form the training-time supervision, we experimented with four FR-IQA metrics, including SSIM (Hore & Ziou| 2010), MS-SSIM (Sara et al. 2019). FSIM et al.) 2011), and DISTS (Ding et al. (2020), producing four variants of our model. The models are referred to as DACOM DACOMMS.SIM. DACOMISIM and DACOMDISTS: In the pro- posed confidence model, employ QualiCLIP, NR-IQA model that operates entirely in self- supervised manner without relying on Mean Opinion Score (MOS) for supervision, as our Image Quality Encoder. We adopt the feature extractor from ARNIQA (Agnolucci al. 2024b) our Distortion Type Encoder, considering its strong capability in identifying distortion types. Further details regarding the selection of Distortion Type Encoder are discussed in the Appendix More details of the experimental configuration of DACOM are provided in the Appendix
FSIM (Zhang
Comparison Methods. We compare DACOM against three categories of methods in our exper-
iments: (1) FR-IQA methods: SSIM, MS-SSIM, FSIM, and DISTS; for clarity, we prefix full- reference metries with "FR-". (2) NR-IQA methods: TOPIQ (Chen al. (0246), ARNIQA, and QualiCLIP. (3) Post-hoc logit calibration (Guo al.) (017). For the logit calibration baseline, the same training set as used for the confidence model employed to normalize the output of each classifier, and the detector's confidence score is given by llogit 0.5).
5.2 CORRELATION BETWERN ESTIMATED CONFIDENCE AND DETECTOR ACCURACY
We first verify whether DACOM can faithfully predict the confidence of given detector. Using the conventional linear- and cank-correlation measures, DACOM achieves a Pearson linear correlation coefficient (PLCC) of 97.73% and Spearman rank correlation coefficient (SRCC) of 94.01 % on the test set, confirming the effectiveness of our strategy. Complete results are reported in Appendix Table & Figure plots average confidence against detection accuracy for both the seen and unseen

---

Published as a conference paper at ICLR 2026
Table I: Performance (%) of multi-detector fusion on the Seen Distortion test sets. For every image we conduct Top-1 routing, using the prediction from the detector whose associated DACOM yields the highest confidence score. "Average" is the mean value over all eight distortion subsets, whereas "Worst" corresponds to the poorest performance observed on any single subset.
Method
JPEG
Blur
Noise
Resize
Color shift
Brightness
Average
Worst
Acc
AP
Acc
AP
Ace
AP
Acc
AP
Acc
AP
Acc
AP
Acc
AP
Acc
AP
CD
94.20
99.28
94,80
99.36
65,70
91.37
96.30
99.90
62.30
90.75
93,80
99.74
84.85
97.07
62.30
90.75
ND
87.10
95.88
93,90
99.01
68.10
80.71
98.70
99.93
54,00
66.79
88.00
98.33
81.63
90.11
54,00
66.79
FregNor"
55.20
67.40
82.40
90.66
50.50
50.87
94.90
98.15
58.70
64.48
86.80
95.02
71.42
77.76
50.50
50.87
NPR
68.50
79.99
91.90
97.85
51.30
51.34
98.90
99.98
67.80
76.86
92.40
98.85
78.47
84.15
51.30
51.34
SAFF
52.30
55.11
63.30
79:31
49.00
06
92.60
99:21
78.20
85.73
93.20
98.39
71.43
77.63
49.00
48.06
C2p
92.70
97.98
81.10
94.15
92.90
99.27
99.20
100.00
90.90
99.05
99.00
99.99
92.63
98.41
81.10
94.15
Logir Calib
92.20
98.07
92,70
97. 59
64. 40
55 46
99.90
100.00
89. 20
92.09
99. 10
99.78
58
90.49
64.40
55,46
DACOMeni
94.00
99.28
94.70
98.91
92.90
99.90
99,05
98,
99.98
DACOMssssio
94,20
99.19
95.
98.92
92,90
99.27
99.40
99.99
90.90
99.05
98,
99.98
95.23
99.40
90,90
99.05
DACOMean
94.20
99.13
95.60
99.38
92.90
99.27
99.60
99.99
90,90
99.05
99.20
99.99
95.40
99.47
90.90
99.05
DACOMESTT
94.30
99.13
95.50
99.37 38
92.90
99.27
99.50
99.99
90.90
99.05
99.00
99.99
95.37
99.47
90.90
99.05
Table 2: Performance (%) of multi fusion on the Unseen Distortion test sets.
Hiasgonn
Stuppring Avi
Aserage
Ase
Ag
Avi
Ap
Ap
Ast
Ag
JAX
Api
Aux
ND
79
20
85
70
59:40
97.17
I0
$2.54
95.07
50.13
Pregher
$2.80
90.23
91.10
9483
01 50
55.00
53.34
$2.80
39.99
60.90
67.33
54.00
38.34
06.30
16.04
74.36
81.25
29:10
99.91
T1U9
13.79
55.90
13.34
NPR
10:30
00.22
0151
00.30
6741
62.99
12.39
96.3:
83.30
93:00
22.46
16.11
66.30
99:11
99.10
56.33
C2P
09.80
10210)
97.30
91.97
94.10
99.99
$3.00
92.08
94.60
95.75
90.20
98.78
74.90
88.94
95.80
98.51
05.00
98.30
100.90
100.99
91.52
56.35
14.90
$8.94
Cakh
91.00
19110
V1.30
TV
94.34
77.30
66.06
12.39
35.90
15.00
75-40
15.95
16.30
W6.35
V5.30
W6.05
104
11.31
18:06
BACOMunn
91.8
190.00
02.00
99.35
94.10
99.59
$3.10
90.24
59.90
95.33
90.70
19.93
54.00
98.25
95.30
5UL55
16,30
99.55
07.00
91.35
52.73
56.33
$4,90
15.24
BMCOMUccay
09:00
191.0)
09.11
34.11
10.00
83.30
91.01
96
05.00 03
1AL50
19.19
$3.40
00:25
95.69
19.54
10.00
19.43
05.55 30
99.0%
00.35
16.04
$1:21
51007
DXCYMcam
97.30
50
N7.00
50170
57
94
98.11
81.30
95.16
distortion test sets. A strong positive correlation is evident for all the involved detetors. Detailed quantitative results are provided in the Appendix G
5.3 RESULTS OF TOP-1 ROUTING IN DETECTOR SCENARIO
We next test whether the estimated confidence can guide an on-the-fly choice among multiple detec- tors. The six detectors described in Section [5.]] are each equipped with its own DACOM. Given an image, six confidence scores are computed and the prediction of the detector with the highest score returned, denoted as 'Topp1 routing" fusion. This strategy is compared against two baselines: (1) using a single detector's output; (2) using the calibrated logit-based confidence to perform Top-1 routing. Results on the Seen Distortion test sets (Table [ show that Top-1 routing with DACOM consistently outperforms the single best detector, demonstrating the effectiveness of confidence model in identifying the most suitable detector for each input. Notably, our best result surpasses logit-based 1 routing by 5.82% in mean accuracy (Acc) and 8.98% in mean average preci- sion (AP). On unseen distortion types (Table 2}. our approach still outperforms logit-based fusion by 2.62% in mean accuracy and 8.45% in mean AP, showcasing its robustness and generalization capabilities, especially under complex distortion conditions such as social media transmission.
5.4 RESULTS OF CONFIDENCE-BASED FILTERING
We finally examine whether DACOM can serve as a reliable basis for rejecting uncertain predic- tions. Experiments are carried out on the Evaluation-dataset and the Cross-dataset, and each image undergoes a single, randomly selected distortion. For every detector we rank all test images by the confidence produced by its corresponding DACOM. Starting from the full set, we iteratively dis- card the lowest-confidence p% of samples and compute the Balanced Accuracy (BAcc) and Equal (Evaluation-datasee) and 4 (Cross-dataset) show
Error Rate (EER) on the retained subset. Tables 3 that, at every filtering rate, DACOM achieves higher BAcc and lower EER compared to the logit- based confidence baseline. The results for random multiple distortions are provided in Appendix H and exhibit similar trend. Furthermore, we plot the Risk- Sose-Coeee (RC) curve (Figure 5). As more low cow-confieence samples are filtered out, the risk on the retained set monotonically decreases, demonstrating the effectiveness of confidence-based filtering.
8

---

Published as a conference paper at ICLR 2026
Table 4: Results Cross-dataset Single-Distortion Filtering (%).
Method
Distortion
Hiltering Proportion
HER
0.30
Topiq
70.65
26.70
21.05
26.11
71.42
25 54
71.31
24.94
72.53
23.85
73.20
22.86
ARNIQA
69.83
QualiCLIP
70.91
26.33
71.50
25.57
71.96
25.02
72.38
24.49
72.92
23.85
73.25
23.49
Logit Calib.
70.81
27.16
71.38
27.08
71.92
27.14
72.29
26,98
73.06
27.07
73.71
27.50
FR-SSIM
70.83
26.54
71.41
25.80
71.97
25.
72.51
24.65
73.31
23.79
74.16
22.89
FR FR-MS- SSIM
FR.FSIM
70.19
27.26
70.66
70.67
26.66
26.70
71.20
71.24
26.00
26.01
71.80
71.82
25.27
25 35
72.35
72.46
24.60
24.61
73.35
73.50
23.54
23.55
74.44
74.49
22.41
22.46
FR-DISTS
70.94
26.52
71.75
25.30
72.48
24.47
73.14
23.70
74.51
22.18
75.73
20.96
DACOMsSM
71.01
26.05
71 86
24.92
72.87
23 89
73,70
25.12
75.37
21.71
77.06
20.09
DACOM
21.95
72.94
21.79
DACOMFSI
70.19
27.26
71.06
26.02
71.97
24.87
72.97
23.58
73,80
23,09
75.46
21.73
77.22
19.89
DACOMOSTS
71.06
25.97
71.95
24.81
72.83
23.88
73.71
23,09
75.54
21.69
77.32
19.87
[a]
(b)
14
14)
0.15
0.27
2.40
0.25
0.28
0.12
0.38
0.2
0.26
025
0.37
0.38
0.05
0.21
0.20
0.35
1.0
0.9
5.8
0.7
0.6
0.5
1.0
0.9
0.8
077
088
0.5
1.5
2.8
0.8
0.7
0.6
0.5
1.0
0.8
0.8
0.7
0.6
05
Covzagg
Coverago
Coveroge
Covorago
+
Tapigo ARNIQA
QualiCUP
+
FR-S5IM
FR-FSIM FR-DISTS
DACaMISSIM) DACOMIMS SSIM)
DACoMIFSIM DACOMIDISTS)
Logit
FR-MS-SSIN
Figure 5: Risk-Coverage (RC) curves with risk defined as 1 - BAcc (x-axis: coverage, y-axis: risk). (a) and (b) show results on the evaluation dataset with single- and multi-distortion, while (c) and (d) present Cross-dataset results under single- and multi-distortion.
5.5 ABLATION STUDY
To disentangle the contribution of each design choice inside DACOM, we evaluate the DACOM en- coder design and the choice of the Image Quality Encoder ΦιQ- As summarized in Appendix in- corporating distortion-sensitivv features from ΦIQ consistently improves regression. The best con- figuration is using QualiCLIP as Image Quality Encoder and including Distortion Type En- coder, achieving the strongest overall performance with the average PLCC of 97.66% and SRCC of 93.9.7% % across detectors. We conducted a comparative study on the mapping functions for trans- forming detectability labels, and the detailed results reported in Appendix Table T8 Among the considered alternatives, our mapping function achieves the best performance.
Table 3: Evaluation-datiin Single- Disttrrosto Filtering (%). Averages over multiple detectors. "Dis- tortion" reports BAcc and EER on distorted sets; "Filtering Proportion" is the fraction of samples removed. Best and second-best are hold and underlined, respectively.
Distortion
Filtering Propartion
|Accc
BER
0.05
0.10
0.15
0.20
0.30
0.40
Topig
84.89
14.51
85.35
14.19
85.90
13.84
86.52
13.21
87.98
11.63
89.30
10.13
QualiCLIP
ARNIQA
84.33
14.79
84.86
85.02
14.27
14,50
85.18
85.69
13.67
86.23
14.38
13.15
85.73
86.76
12.64
14.27
87.89
85.53
11.58
14.86
85.80
85.55
10.86
14.45
Login Calib.
10.73
FR-SSIM FR-MS SSIM
85.34
13:97
86.22
13:21
87.10
12.36
87.87
11.44
99.31
10.32
90.95
8.80
84.43
$1.90
84.93
14.46
85.63
13.81
86.49
13:04
13.34
87.22
12.30
58.60
10.89
90.40
9.22
8.05
PR-DISTS
84.98
14.39
85.79
13.76
86.67
12.8%
87.3 85
11.64
90.23
9.29
92.28
7.46
DACOMSEM
91.61
5.35
DACOMESSSSR
DACOMPEN
84.43
14.79
36:04
86.04
13.10
13.05
87.56
$7.60
11.43
11.57
89.05
89.03
10.41
10.44
90,00
89.98
9.18
9.14
91.70
91.67
7,06
7.11
93.35
93.32
5.27
5,26
DACOMESTS
86.17
12.96
87.66
89.05
9.21
93.52
5.12

---

Published as a conference paper at ICLR 2026
6 CONCLUSION
This work takes the problem of Al-generated image (AIGI) detection test-bed and offers the first systematic analysis of detector reliability in the presence of common, real-world distortions. We show that the raw outputs of detectors cannot convey sample-level confidence once images are degraded. and we introduce DACOM, a distortion aware confidence model, to enable detectors to output confidence score for each image under distortion. Experiments across diverse distortions and detectors support three findings: (i) FR-IQA-base distortion levels align more strongly with forensic performance than no-reference IQA (NR-IQA) scores; (ii) distortion effects detector- and type-dependent-even at matched intensities-reveallin systematic interaction patterns; and (iii) the proposed confidence model enables effective sample-level filtering and multi-detector fu- sion, improving overall reliability. Despite these advances, DACOM exhibits degraded performance cross-dataset evaluation, reflecting sensitivity changes the data source distribution. To address this, we will explore more general and shift-resilient formulations of distortion-awand detector-conditioned reliability modeling, strengthening the framework as foundation for relia- bility estimation under real-world degradations.
ACKNOWLEDGMENTS
This work was supported in part by NSFC (Grant U23B2022, U22B2047, 62572325, 62371301), Shenzhen R&D Program (Grant JCY120250604181211 11111106, SYSPG200412211740030000 dong Basic and Applied Basic Research Foundation (Grant 2025A1
Guang-
REFERENCES
Lorenzo Agnolucci, Leonardo Galteri, and Marco Bertini. Quality-aware image-text alignment for opinion-unaware image quality assessment. arXiv preprint arXiv:2403.1 11176, 2024a.
Lorenzo Agnolucci, Leonardo Galteri, Marco Bertini, and Alberto Del Bimbo. Amiqa: Learning distortion manifold for image quality assessment. Proceedings of the IEEE/CVF Winter Con- ference Applications of Computer Vision, pp. 189-198, 2024b.
Charles Blundell, Julien Cornebise, Koray Kavukcuoglu, and Daan Wierstra. Weight uncertainty in neural network. In International conference on machine learning, pp. 1613-1622. PMLR, 2015.
Baoying Chen, Jishen Zeng, Jianquan Yang. and Rui Yang. Dret: Diffusion reconstruction con- trastive training towards universal detection of diffusion generated images. In Forty-first Interna- tional Conference on Machine Learning, 2024a.
Changsheng Chen, Lin Zhao, Rizhao Cai, Zitong Yu, Jiwu Huang, and Alex C. Kot. Forensicability assessment of questioned images in recapturing detection. CoRR, 0tbp/2209,01935, 2022. doi: 10. 48550/AARXIV22000.11999 URL httptt://///ooooo org.0/...r..1... 405.0/8550///0
Chaofeng Chen, Jiadi Mo. Jingwen Hou, Haoning Wu, Liang Liao, Wenxiu Sun, Qiong Yan, and Weisi Lin. Topiq: A top-down approach from semantics to distortions for image quality assess- ment. IEEE Transactions on Image Processing. 33:2404-2418. 2024b.
Xiaoyu Chu, Yan Chen, Matthew C Stamm, and KJ Ray Liu. Information theoretical limit of media forensics: The forensicability. IEEE Transactions on Information Forensics and Security, 11()): 774-788, 2015.
Keyan Ding, Kede Ma, Shiqi Wang, and Eero P Simoncelli. Image quality assessment: Unifying structure and texture similarity. IEEE transactions on pattern analysis and machine intelligence, 44(5):266-25811 2020.
Yarin Gal and Zoubin Ghahramani. Dropout bayesian approximation: Representing model uncertainty in deep learning. In international conference on machine learning, pp. 1050-1059.
PMLR, 2016.
10

---

Published as a conference paper at ICLR 2026
Ian J Goodfellow, Jean Pouget-Abadic Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014.
Diego Gragnaniello, Davide Cozzolino, Francesco Marra, Giovanni Poggi, and Luisa Verdoliva. Are gan generated images easy to detect? critical analysis of the state-of-the-an art. In 2021 IEEE international conference on multimedia and expo (ICME), pp. 1-6. IEEE, 2021.
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. In International conference on machine learning, pp. 1321-1330. PMLR, 2017.
Qixian Hao, Ruyong Ren, Shaozhang Niu, Kai Wang, Maosen Wang, and Jiwei Zhang. Ugee-net: Uncertainty-guit -uiided and edge-enhanced network for image splicing localization. Neural Networks, 178: 106430, 2024.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-688 2020.
Alain Hore and Djemel Ziou. Image quality metrics: Psnr vs. ssim. In 2010 20th international conference on pattern recognition, pp. 2366-2369, IEEE, 2010.
Kaixiang Ji, Feng Chen, Xin Guo, Yadong Xu, Jian Wang, and Jingdong Chen. Uncertainty-guider learning for improving image manipulation detection. In Proceedings of the IEEE/CVF interna- tional conference on computer vision, pp. 02456-22465 2023.
Hyunjoon Kim, Jaehee Lee, Leo Hyun Park, and Tackyoung Kwon. On the correlation between deepfake detection performance and image quality metrics. In Proceedings of the 3rd ACM Work- shop on the Security Implications of Deepfakes and Cheapfakes, pp. 14-19, 2024.
Balaji Lakshminarayanan. Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. Advances neural information processing systems, 30, 2017.
Jialiang Li, Haoyue Wang. Sheng Li, Zhenxing Qian, Xinpeng Zhang, and Athanasios V Vasilakos. Are handcrafted filters helpful for attributing ai-generated images? In Proceedings of the 32nd ACM International Conference on Multimedia, pp. 10698-10706, 10706, 2024a.
Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Fuli Feng. Improving synthetic image detection towards generalization: An image transformation perspective. arXiv preprint arXiv:2408.06744 2024b.
Yuanman Li, Jiaxiang You, Jiantao Zhou, Wei Wang, Xin Liao, and Xia Li. Image operation chain detection with machine translation framework. IEEE Transactions Multimedia, 25:6852-6867, 2023. doi: 10. 10.11099/MM.2222.211500
Shiyu Liang, Yixuan Li, and Rayadurgam Srikant. Enhancing the reliability of out-of-distribution image detection in neural networks. arXiv preprint urXiv:1706.02690. 2017.
Xun Lin, Shuai Wang, Rizhao Cai, Yizhong Liu, Ying Fu, Wenzhong Tang. Zitong Yu, and Alex Kot. Suppress and rebalance: Towards generalized multi-modal face anti-spoofing. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 211-221111111111112 2024.
Anish Mittal, Anush Krishna Moorthy, and Alan Conrad Bovik. No-reference image quality assess- ment in the spatial domain. IEEE Transactions image processing, (6111)))6665-7788 2012.
Mahdi Pakdaman Naeini, Gregory Cooper, and Milos Hauskrecht. Obtaining well calibrated proba- bilities using bayesian binning. In Proceedings of the AAAI conference artificial intelligence, volume 29, 2015.
Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detectors that generalize across generative models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 11480-24489, 2023.

---

Published as a conference paper at ICLR 2026
Wenyan Pan, Wentao Ma, Tongqing Zhou, Shan Zhao, Lichuan Gu, Guolong Shi, and Zhi- hua Xia. Dual-deccupling with requency-spattie domains for image manipulation localiza- tion. IEEE Transactions Neural Networks and Learning Systems, pp. 1-11, 2024. doi: N0.1009/TNNLS2204444442222
Cecilia Pasquini and Rainer Böhme. Information-theerriicc bounds of resampling forensics: New evidence for traces beyond cyclostationarity. In Matthew C. Stamm. Matthias Kirchner, and Sviatoslav Voloshynovskiy (eds.), Proceedings the 5th ACM Workshop Information Hid- ing and Multimedia Security, IH&MMSec 2017, Philadelphia, PA, USA, June 20-22, 2017, pp- 3-14. ACM, 2017. doi: 00.1145/30220313003225, URL https:/ /tw.//iiiooooooo otw..ooo.oooo..ooooooooooooooo.. 10. 1145/ 3082031 3083233
Cecilia Pasquini and Rainer Böhme. information-thhoreee bounds for the forensic detection of downscaled signals. IEEE Transactions on Information Forensics and Security, 14(7):198811433, 2018.
Umme Sara, Morium Akter, and Mohammad Shorif Uddin. Image quality assessment through fsim, ssim, mse and psnr-a comparative study. Journal of Computer and Communications, 7(3):8-18, 2019.
Alexander Schlögl, Tobias Kupek, and Rainer Böhme. Forensicability of deep neural network infer- ence pipelines. In ICASSP 2021 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2515-25111 2519, 2021. doi: 10.1109/CAASSP397288.00 (000229941430 99144301.
Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, and Yunchao Wei. Learning on gradients: Generalized artifacts representation for gan-generated images detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12105-12114 2023.
Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Frequency- aware deepfake detection: Improving generalizability through frequency space domain learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 5052-5060, 2024a.
Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethinking the up-sampling operations in enn-based generative network for generalizable deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp-
28130-28139, 2024b.
Chuangchuang Tan, Renshuai Tao, Huan Liu, Guanghua Gu, Baoyuan Wu, Yao Zhao, and Yunchao Wei. C2p-clip: Injecting category common prompt in clip to enhance generalization in deepfake detection. Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 7184- 7192, 2025.
Renshuai Tao, Manyi Le, Chuangchuang Tan, Huan Liu, Haotong Qin, and Yao Zhao. Oddn: Ad- dressing unpaired data challenges in open-world deepfake detection online social networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 799-807, 2025.
Joost Van Amersfoort, Lewis Smith, Yee Whye Teh, and Yarin Gal. Uncertainty estimation using single deep deterministic neural network. International conference on machine learning, pp- 9690-9700. PMLR, 2020.
Joost Van Amersfoort, Lewis Smith, Andrew Jesson, Oscar Key, and Yarin Gal. On feature collapse and deep kernel learning for single forward pass uncertainty. arXiv preprint arXiv:2102.11009, 2021.
Sheng- Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Con-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 8695-8704, 2020.
Zhendong Wang. Jianmin Bao, Wengang Zhou, Weilun Wang. Hezhen Hu, Hong Chen, and Houqiang Li. Dire for diffusion generated image detection. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 22445-22455 2023.
diflusion-generatedd
12

---

Published as a conference paper at ICLR 2026
Jiale Zhang. Yulun Zhang, Jinjin Gu, Yongbing Zhang, Linghe Kong, and Xin Yuan. Accurate image restoration with attention retractable transformer. arXiv preprint arXiv:2210.01427, 2022.
Lin Zhang, Lei Zhang, Xuanqin Mou, and David Zhang. Fsim: A feature similarity index for image quality assessment. IEEE transactions on Image Processing, 2078):237- 2011.
Yuanhan Zhang, Yichao Wu, Zhenfei Yin, Jing Shao, and Ziwei Liu. Robust face anti-spoofing with dual probabilistic modeling. Pattern Recognition, pp- 11 11000 2025.
Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li. Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang. Genimage: A million-scall benchmark for detecting ai-generated image. Advances in Neural Information Processing Systems, 36:77771-77782 2023.
13

---

Published as a conference paper at ICLR 2026
A IQA METRICS AND DETECTION PERFORMANCE
(P40 0.00
60% cd)
1840 8:30
(000
8846 8.40
1930 6400
R550 0.00000
8048
1946
8440
Abtortion
PPG
Digaten
Aeate
MXz
Rechet
Deettet Wedo
Dighter
Hamr
Rectee
MaChee
Gendor Hoko
Nide
Dallen
Cool
Made
Opden
Gool
Byy
MN2
00
(a) Dists with CD
(b) Qualiclip CD
2035. 220
89 6M)
530
cam
4300
19 dati
4.00
8 5.60
Abtortion
Distartien
(c) MS-SSIM with c2p*
(d) Qualiclip with c2p*
1031 E
(-40 dus)
B.0. san
1810 eas
j81s 25a)
mun sud))
8-70
0:21
axd
(822 (29)
1940 aidl
19 6:4
8511 aum)
1940 45u
13 adu
R0 pm.. mm
Disteriio
Doetrriao
5CC Na5e
drgitve Rkm Aeter
Bertre
MeCuve Danadoo
PTC
Argttee Oprett
Mkm
Bertre
MM1 + ReOve Rodes
Gox
Biy
V52
00
Melo
Na50
Cod
Bay
00
Wel
SSIM with ND
ARNIQA with ND
Figure 6: Relationship between IQA Metrics and Model Detection Performance.
We present the correlation between IQA scores and model detection performance for broader set of distortion types in Figure The results indicate consistently strong correlation across diverse distortion categories.
B DISTORTION TYPES, FR-IQA, AND MODEL LOGIT DISTRIBUTIONS
We visualize the drift in output logit distributions of various detectors as the distortion severity increases (indicated decrease in FR-IQA metrics). As shown in the Figure we observe that different detectors exhibit distinct distributional shifts under the same distortion type and severity.
In Figure (a)-(c), under Gaussian white noise with increasing intensity, both and SAFE* exhibit a shift of the fake distribution toward the real distribution, whereas NPR* shows the opposite trend. In Figure (d)-(f), under color shift distortions, CD shows shift of the fake distribution toward the real one; F FreqNet. displays convergence of both distributions toward the decision boundary; and C2P behaves oppositely to CD. In Figure 7 (i), under distortions introduced by four different social media platforms, CD consistently shows the fake distribution shifting toward the real one; NPR* exhibits a convergence of both distributions toward the center; and SAFE* demonstrates a complete shift of the real distribution into the domain of fakes. These results indicate that under identical distortion conditions, different detectors are affected dissimilarly, leading to varied patterns of misclassification.
14

---

Published as a conference paper at ICLR 2026
(a) CD with white noise
(b) NPR with white noise
SAFE' with white noise
(d) CD with color cooling
(c) FreqNet" with color cooling
(f) C2P" with color cooling
gg) CD with media platforms
(h) NPR with media platforms
(i) SAFE" with media platforms
Figure 7: The logit distribution shifts under the influence of distortion. Blue/yellow: clean real/fake; green/red: distorted real/fake.
Real
Fake
AIl
Joog
Nolse
Resice
Worm
Cold
Brighten
Darken
Suturation
I8ttggmm
Sharpening
Figure 8: Distribution of FR-IQA Scores Across Distortion Types (SSIM).
15

---

Published as a conference paper at ICLR 2026
Real
Fake
All
Noise
Mlttggrm
Sharpaning
Mixa
Mix2
SRx2
WeChet
Q4
Wolbs
Facebook
Figure 9: Distribution of FR-IQA Scores Across Distortion Types (MS-SSIM)
Real
Fake
All
Jpe9
Noise
Matogram
Sharpaning
Midi
MBa
5Rx2
WeChet
09
WeiBo
Pacebook
Figure 10: Distribution of FR-IQA Scores Across Distortion Types (FSIM).
16

---

Published as a conference paper at ICLR 2026
Real
Fake
AIl
Brighten
Saturation
Msttgram
Sharpening
Mix1
Mix
SRx2
WeChat
WelBo
Facebook
06
Figure 11: Distribution of FR-IQA Scores Across Distortion Types (DISTS).
C DISTRIBUTION OF IMAGE QUALITY ASSESSMENT SCORES UNDER DISTORTION
We visualize the distribution ranges of full-reference image quality assessment (FR-IQA) scores across different datasets of distortion types, as shown in Figures 8 11 The distortion types from top to bottom are: JPEG, Blur, Noise, Resize, Color warming, Color cooling, Brighten, Darken, Saturation, Histogram, Sharpening, Mix1, Mix2, SRx2, WeChat, QQ, WeiBo, and Facebook. For each distortion type, present the bination. Several key observations can be made. First, the score ranges vary considerably across distortion types. For instance, the scores for JPEG compression consistently fall within [0.8, 1.0] across all four FR-IQA methods, and similar concentration is observed for the four social media platforms (WeChat, QQ, WeiBo, Facebook). Second, the distributions for real and fake images are highly consistent for each distortion type. This indicates that the FR-IQA methods perceive the overall quality of real and fake images similarly, without being significantly affected by potential artifacts. This property ensures that our approach treats both real and fake data fairly.
distributions for real images, fake images, and their com-
D DATASET DETAILS
We randomly sample 4,000 images (with an equal number of real and fake samples) from the Pro- GAN set (totaling 8,000 images) (Wang et al. (202)) to form the base dataset for the confidence model. Based on this, we design eight common distortion types: JPEG compression, blur, additive white Gaussian noise, resize, darkening, brightening, and two types of color shift. Each distortion type is applied at 10 intensity levels, generating 40,000 distorted images per type (covering all inten- sities of that distortion), resulting in a total of 320,000 distorted images for training and evaluating the regression performance of the confidence model. During training and evaluation, the original 4,000 images are split into 2,500/500/1 1,000 for the training, validation, and test sets, respectively. After applying distortions, the overall dataset sizes become 202.500, 40,500, and 81,000 for these three subsets. The remaining 4,000 images from the ProGAN test set are reserved as an independent Evaluation-datasee and involved in the training validation of the confidence model.
17

---

Published as a conference paper at ICLR 2026
Table Dataset construction with distortions, number of samples, and sources.
Dataset
Distortion
Number
Source
Training
JPEG, Blur, Noise, Resize,
202,500
samples from ForenSynths ProGan
Validation
Color warming. Color cooling,
40,500
500 sumples from ForenSyuths ProGan
Test
Brighten. Darken
81,000
samples from ForenSyuths ProGan
JPFG
1,000
Blur
1,000
Seen Distortion
Noise
1,000
tesl sets
Resize
1,000
Color shift
1,000
Brightness
1,000
Mix1
1,000
Mix2
1,000
From the same data split as the test
Saturation
1,000
Histogram
1,000
Unseen Distortion
Shamening
1,000
test sets
SR (2x upscaling)
1,000
QQ
1,000
WeChat
1,000
Weibo
1,000
Facebook
1,000
Eyaluation-datase
rundomly select
single distortion
one distortion type
4,000
4000 samples from ForehSyaths Progan
Evaluation-dutaen
randomly combine
multiple distortions
2-4 distortion types
4,000
Subwets for which the detector achieves reasonable performance (accuracy 0.75)
Cross-dataset single distortion
randomly seleet one distortion typc
ForenSynths:
(Stylegan, Stylegan2, Biggan,
Cyclegan, Stargan, Gaugan, Deepfake)
Universal: (glide_100_10, glide_100_27, 2tlic_100.77gglidd.50..77 gl.dc.50.227
DALLE, kdm 100, Idm 200, Idm 200 efg).
GenImage: {ADM, BigGAN, glide, Midjourney,
Cross-dataset
randomly combine 2-4 distortion types
SD.v14, SD_v15. VQDM).
multiple distortions
DiTFake: (FLUX, PixArt. SD3)
To further evaluate the model's generalization capability, we construct test sets containing both seen and Unseen Distortions. Seen Distortion test sets. We merge Brighten and Darken into Bright- ness, and Color warming and Color cooling into Color shift. For each of the six distortion types mentioned above, we apply a randomly selected intensity to every image in the test set (original im- ages), resulting in six corresponding distorted subsets. Unseen Distortion test sets. This includes the following ten categories: (1) Mixl: Randomly selects 2-4 distortion types from (JPEG, Blur, Noise, Resize) } and combines them randomly; (2) Mix2: Similarly selects 2-4 types, but fixes JPEG the final distortion step (with others applied randomly before).; (3) QQ platform transmission; (4) WeChat platform transmission; (5) Weibo platform transmission; (6) Facebook platform transmis- sion; (7) Saturation adjustment; (8) Histogram equalization; (9) Image sharpening: using the unsharp mask (USM) enhancement algorithm; (10) Super- Resolutino (2x upscaling): performed with Transformer-basse architecture (Zhang al. (2022).
Table 6: The types of distortions and their corresponding intensities used in the training set. "Pa- rameter Range" indicates the closed interval "[min, max]" for single distortion.
Distortion Type
Parameter Range
Step
JPEG
[24, 96]
8
Gaussian blur
[0.3, 3.0
0.3
Noise
[0.0002, 0.002]
0.0002
Resize
[0.20, 0.92]
0.08
Color warming
[1.05, 1.5
0.05
Color cooling
[0.5, 0.95
-0.05
Brighten
[0.05, 0.5
0.05
Darken
0..,, 0.005
-0.05
Additionally, in the sample filtering experiments, introduce Cross-datased evaluation based on the Evaluation-dataset. Specifically, from the three dataset collections Foriiinns-F (Wang et al. 2020), Universal (Ojha al. 2023). Genlmage (Zhu al. 2023) and DiTFake (Li et al. 2024b
18

---

Published as a conference paper at ICLR 2026
Table 7: The types of distortions and their corresponding intensities applied in the test set. We only list distortion types with tunable parameters; Histogram, Super-Resolution (2x), QQ. WeChat, Weibo, and Facebook have no adjustable parameters and are omitted. For "Mixl" and "Mix2", pa- rameter ranges are not fixed; instead, each component distortion randomly samples its intensity from its own range. The "Sharpening" distortion uses the Unsharp Mask algorithm internally, controlled by radius (blur extent) and amount (enhancement strength).
Distortion Type
Parameter Range
Step
JPEG
[24, 100]
2
Gaussian blur
[0.15,
0.15
Noise
[0.0001, 0.002]
0.0001
Resize
[0.5, 1.5)
0.2
Color shift
00.5, 1.5
0.2
Saturation
00.1, 1.9
0.2
Brightness
[-0.5,
0.2
Sharpening
radius: [1,5], 5). amount: [0.5.3]
Random within ranges
Mix1
Random 2-4 from (JPEG, Blur, Noise, Resize]
Per-distortion random
Mix2
Random 1-3 from above set JPEG
Per-distortion random
we select subsets on which the detector achieves reasonable performance (accuracy > 0.75). Note that the number of selected subsets may vary across detectors due performance differences. We then apply single distortions (randomly selecting one distortion type and intensity) and multiple distortions (randomly combining distortion types) to these subsets, limiting the distortions to the eight types already encountered by the confidence model. Table | presents the full details of summarize the distortion types and their corresponding parameter
our datasets, while Tadd Zummarriizz ranges used in the training and test sets, respectively.
E DISTORTION TYPE CLASSIFICATION MODEL
To investigate whether features from NR-IQA methods can be used for explicit distortion identifi- cation, we report the distortion-type typo classification results of several NR-IQA methods (ARNIQA, QualiCLIP, Topiq (Chen et al.) (2024)) and BRISQUE (Mittal (012)). We freeze the feature extractors of each NR-IQA model and directly feed their output features into a classification head for distortion-type classification.
We sample 9,600 distorted images from the distorted dataset, covering eight types of distortions: JPEG compression, noise, resizing, blur, darken, brighten, and two types of color shifts ("Sat Down" corresponding to Cool and "Sat Up" corresponding
Warm). Among these, 8,000 images are used train classifier, and 1,600 are reserved for testing. We visualize the confusion matrices corresponding to the best classification performance achieved by each NR-IQA method over 100 epochs, as shown in the figure [2 "Sat Down" and "Sat Up" refer to the two specific types of color shifts. It can be intuitively observed that ARNIQA achieves the best classification accuracy, followed by QualiCLIP. Therefore, we select ARNIQA as the Distortion-Tyl TType Encoder our method section.
Table 8: Regression performance of DACOM across detectors trained with different FR-IQA (SSIM, MS-SSIM, FSIM, DISTS). Evaluated by PLCC and SRCC on the test set; all methods yield consistently high scores, supporting the proposed FR FR-guided supervision strategy.
ND
NPR'
FrogNett
SAFE
C2P'
Average
Method
PLOC
SRCC
PLCCC
SRCC
PLCC
SRCC
PLCC
SRCC
PLCCC
SRCC
PLOCC
SRCC
PL.CC
SRCC
DACOM
97.71
90.10
97.71
95.44
98.59
95.91
97.74
95.49
98.15
95.76
96.05
91.11
97.66
93.97
DACOMPs
98.03
90.55
97.70
95.57
98.62
96. 12
97.77
95.54
98.
95.08
96.01
91.23
97.73
94.01
DACOMrans
97.65
90.83
97.75
94.79
90.18
DACOMOSSTS
97.70
90.93
97.59
95.21
98.64
96.38
97.77
95.54
98.16
95.70
96.05
91.70
97.65
94,24
19

---

Published as a conference paper at ICLR 2026
0.93
0.02
0.00
1.50
0.01
0.03
Brighteen
0.42
0.02
0.00
0.00
0.00
2.00
0.02
0.12
Darken
5.43
5.50
0.48
0.02
0.03
0.00
0.00
5.50
0.02
0.00
5.04
0.05
0.00
5.00
0.01
6.43
0.07
0.02
0.01
0.01
0.13
0.03
0.00
Jpep
0.04
6.69
0.00
0.02
0.97
0:00
9.00
0.03
0.00
0.00
0.02
0.00
0.03
Down
Up-
Up-
Brightan
Darton
Gonosiien Mar
Beat Drwwn
Brigstees
Hone
Gooesson
Boo
Set
(a) ARNIQA
(h) QualiCLIP
Brighten
0:55
0.10
Brighten
C.33
0.14
0:13
0.15
0.00
0.02
0.14
0.12
Darken
0.00
0.62
0.05
0.10
0.67
3.03
0.07
0.12
Darken
C.47
0.18
0.03
0.30
5.00
3.03
0.13
0.13
4.0
Gousstan Blur
0.63
0.00
0.59
0.01
0.43
3.34
0.01
0.01
24
Geussian Blur
C.43
0.00
0.00
0.01
0.00
3.00
0.01
0.01
56
Jomg
0.08
0.05
0.00
0.59
5.06
3.05
0.03
0.09
Jpep
0.65
0.30
0.09
0.05
0.00
3.01
0.04
0.09
Noice
0.08
0.91
0.0b
3.00
8.56
3.00
0.01
0.00
Nolee
0.03
0.01
0.01
0.00
5:56
1.00
0.02
0.00
Reddow
0.61
0.90
0.30
3.04
2:01
2.82
0.01
0.00
Rmdin
0.61
0.02
0.12
0.01
5.00
1:43
0.02
0.00
Sat Dewn
0.05
0.03
0.01
3.00
5:01
0.02
0:1
0.00
Sat Down
0.15
0.23
0.30 0.32
5.00
0.03
0.21
0.09
Sat
0.69
0.03
0.06
3.00
1:66
3.01
0.01
0:75
Sat Up
C.33
0.21
0.30
0.12
5:00
3.34
0.17
0.12
Brightan
Barkan
Gaunstan Bisr
Restor
Sot Dowen
Sat Up
Brighan
Barken
Goumston Barr
Hand
Hoise
Brewn
Up
(c) Topiq
(d) BRISQUE
Figure 12: Confusion Matrix for Distortion Type Classification
F IMPLEMENTATION DETAILS
For our distortion-aware confidence modeM(DACOM), we employed the Adam optimizer with weight decay term. The batch size was set to 64, and the model was trained for 5 epochs with an initial learning rate of 10 A linear warm-up strategy was applied during the first epoch, where the learning rate increased gradually from 10% of the initial value to the full rate. After the warm-up, cosine annealing schedule was used, with the minimum learning rate set to 5% of the initial value. Model checkpoints are selected based on the highest SRCC achieved on the validation set. The input the Confidence Model's Image Quality Encoder and Distortion-Typp Encoder is of size 256x256 pixels, while the input to the Forensic Detector Encoder is processed according to the specific requirements of the corresponding detector.
G DISTORTION-TYPR CONFIDENCE WITH DETECTION PERFORMANCE
Table 9: Correlation between Distortion- -Tppe Confidence and Detection Performance (%).
ND
NPR'
FrogNett
SAFE
C2P'
Average
Method
PLOC
SRCC
PLOC
SRCC
PLCC
SRCC
PLCC
SRCC
PLCC
SRCC
PLOC
SRCC
PLCC
SRCC
DACOM
93.25
83.82
86.49
86.18
90.83
85.80
90.67
86.76
98.23
88.95
71.65
75.94
88.52
84.58
DACOMys sSIM
93.10
87.35
85,79
87.94
92.34
89.92
92.35
88.53
98.38
88.07
71.63
79.18
88.93
86.83
DACOMMaR
92.78
81.47
85.13
86.47
91.55
92.18
97.54
90.43
67.99
80.50
85.51
DACOMBISTS
93.78
81.76
85.93
87.65
92.29
88.01
90.99
87.35
98.33
90.13
69.81
82.27
88.52
86.19
The regression performance of DACOM across all detectors is summarized in Table 8 We evaluate the relationship between the average confidence and accuracy of our proposed confidence model on datasets comprising various distortion types, including both seen and unseen distortions, As shown in the Table 9 we report the PLCC and SRCC correlation metries between average confidence and
20

---

Published as a conference paper at ICLR 2026
aceuracy. Using MS- AS-SSIM the full-reference IQA method, the model achieves average PLCC and SRCC values of 88.93% and 86.83%, respectively. Experimental results demonstrate that the confidence model generalizes well across different distortion types, and its outputs exhibit strong correlation with detection performance, effectively predicting the likelihood of correct detection.
H MULTI-DISTORTION FILTERING
As shown in Table and Table 11 we present the filtering results under random multiple distortions for the iyaluation-dataset and Cross-datane respectively. This setting is particularly challenging, especially for Cross-dataset, as most compared methods show limited performance gains. While this is the case, our approach still manages achieve competitive results BAcc and EER across most screening ratios.
Table 10: Results Evaluation-dataset Multi-Distortinn Filtering
Distortion
Filtering Proportion
Method
BAce f EER
0.05
0.10
0.15
0.20
0.30
0.40
Topiq ARNIQA
73.05
25.38
73.31
25.22
73.61
24.98
73.80
24.70
74.47
24.03
75.22
23.33
72.94
25.70
73.03
25.66
73.11
25.62
73.34
25.56
73.65
25.57
73.84
25.35
72.79
25.77
QualiCT.IP
73.22
25.24
73.54
24.88
74.08
24.37
23.98 74.55
75.35
23.25
76.12
22.66
Logit Calib.
25.50 73.63
74.45
25.43
75.01
25.37
25.41 75.45
75.92
25.15
76.46
24.69
FR-SSIM
73.33
25.17
73.82
24.76
74.48
24.02
75.00
23.50
76.03
22.59
77.15
21.60
FR-MS-SSIM
73.14
25.36
73.51
24.90
73.79
24.64
74.28
24.26
75.19
23.39
76.31
22.28
72.79
25.77
FR-FSIM
73.00
25.52
73.21
25.33
73.66
24.95
74.03
24.61 74.29
74.72
23.79
75.94
22.45
FR-DISTS
73.26
25.21
73.56
24.93
73.97
24.53
24.14
75.32
23.07
76.69
21.63
DACOMSSIM
73.78
24.61
74.69
23.54
75.70
22.63
76.70
21.70
78.02
20.24
78.72
19.09
DACOM MMMSS-SSMMM
73.77
24.55
74.61
23.62
75.76
22.60
76.73
21.64
78.18
20.11
78.83
19.01
72.79
25.77
DACOMFSIM
73.79
24.53
74.75
23.46
75.72
22.64
76.73
21.66
78.29
20.11
78.70
19.06
DACOMDISTS
73.87
24.51
74.83
23.46
75.91
22.42
21.56
78.26
20.13
78.95
18.76
Table 11: Results on Cross-dataset Multi-Distortion Filtering
Distortion
Filtering Proportion
Method
BAce BER U
0.05
0.10
0.15
0.20
0.30
0.40
Topiq ARNIQA
60.86
35.95
61.06
35.68
61.31
35.40
61.55
35.06
61.94
34.62
62.47
33.84
60.64
36.20
60.54
36.29
60:46
36.35
60.41
36.50
60.44
36.44
60.32
36.64
60.10
36.74
QualiCT.IP
61.00
35.76
61.37
35.21
61.70
34.83
61.98
34.49
62.54
33.82
63.06
33.42
Logit Calib.
60.68
36.37
60.69
36.68
37.08
60.71
37.47
60.81
37.80
61.12
38.28
FR-SSIM FR-MS-SSIM
60.95
35.85
61.27
35.53
61.61
35.09
61.96
34.76
62.72
33.98
63.46
33.41
60.82
36.06
61.11
35.77
61.42
35.46
61.77
34.96
62.48
34.17
63.20
33.45
60.64
36.20
FR-FSIM
60.83
36.00
61.04
35.84
61.29
35.11
61.60
35.21
34.45
63.14
33.64
FR-DISTS
61.03
35.72
61.44
35.24
61.83
34.70
62.22
34.34
63.08
33.36
32.54
DACOMSUM DACOMsis SSIM
60.93
35.71
61.30
35.06
61.73
34.50
62.21
33.96
63.15
33.06
64.02
32.46
60.64
36.20
60.95
35.65
61.35
35.00
61.79
34.43
62.28
33.86
63.20
33.02
64.05
32.29
DACOMESIM
60.96
35.71
61.35
35.07
61.77
34.54
62.36
33.89
63.35
32.97
64.12
32.33
DACOMIISTS
60.97
35.64
61.34
35.01
61.77
34.44
62.25
33.85
63.22
32.98
64.19 32.23
I APPLICABILITY OF DACOM ACROSS DIFFERENT DATA DOMAIN
We retrained our detector on the SD14 subset GenImage ZZhu et al. 2023 following the same experimental protocol and hyperparameter configuration. During training, F FreqNet and SAFE failed to converge under the required augmentation pipeline-likely due to sensitivity to the high- frequency artifacts and distributional characteristics of diffussion-generaee images. Therefore, report results only for CD. ND, NPR, and C2P. Similarly, C2P uses the SD14-pretraine weights. All models, including DACOMDISTS, are trained SD14, and baselines temperature-sealed logit calibration. The distortion types and data volume used during training and evaluation are fully consistent with the original paper's configuration. We compare proposed method (using
21

---

Published as a conference paper at ICLR 2026
DACOMDISTS example) against the outputs of the calibrated detectors. As shown in the Table 12 DACOMDISTS consistently outperforms baseline calibration methods across both seen and unseen distortions, delivering superior average and worst-case performance.
Table 12: Multi-detector fusion performance on SD14 (%; Acct APP)
Scon distortion
Unscen distortion
Average
Worst
Method
Acc
AP
Acc
AP
Acc
AP
Acc
AP
Logit Calib.
91.85
99.00
94.64
98.67
93.59
98.79
72.70
90.
DACOMpsSTs
97.70
99.70
96.10
98.95
96.70
99.23
81.60
93.38
Moreover, it facilitates more favorable precision-coverage trade-off for confidence-based filtering on SDI4, and generalizes well to cross-dataset evaluation on SD15. As shown Tables 16 DACOM consistently surpasses baseline in the filtering task across every aetting-includig in- domain and cross-domain datasets, as well as both single- and multi-distortion scenarios.
Table 13: Distoo-Dstootiinn filtering (%) in SD14
Distortion
Filtering Proportion
Method
BAcc t EER
0.10
0.20
0.30
0.40
Logit Calib.
87.77
11.82
89.88
11.46
10.78
92.62
9.72
94.20
8.38
DACOMPISTs
87.77
11.82
90.31
7.97
92.68
5.22
94.29
4.02
95.50
2.92
Table 14: Single-Distortion filtering (%) in SD15
Distortion
Filtering Proportion
Method
BAce t BER
0.10
0.30
Logit Calib.
87.74
11.60
89.78
11.31
91.18
10.81
92.62 9.93
94.06
8.60
DACOMpiSTs
87.74
11.60
90.28
7.77
92.69
5.18
94.34
3,89
95.55
2.95
Table 15: Multi-Distortion filtering (%) in SD14
Distortion
Filtering Proportion
Method
BAce
BER
0.10
0.20
0.30
0.40
Logit Calib.
76.81
21.76
77.77
22.66
78.19
23.63
78.44
24.42
78.62
24.75
DACOMo1sTs
76.81
21.76
78.69
18.93
81.01
15.80
83.00
13.90
84.51
12.48
Table 16: Multi-Distortion filtering (%) in SD15
Distortion
Filtering Proportion
Method
BAce f EER
0.10
0.20
0.30
0.40
Logit Calib.
76.21
22.12
77.36
23.12
77.74
24.17
77.97
25.00
77.99
25.61
DACOMDIsTs
76.21
22.12
78.01
19.52
80.52
16.32
82.54
14.17
83.95
12.76
J ABLATION RESULTS
As shown in Table 17 our ablation study shows that adding each proposed module leads to a substan- tial increase in both PLCC and SRCC, demonstrating their individual necessity and effectiveness.
Table 18 reports the impact of different mappings (e.g., linear, power-law, logarithmic) on the final routing performance. The results show that the simple linear mapping (Linear) achieves the best performance. This observation reveals an intriguing empirical regularity: in a statistical sense, the detector's 's detectability strength is approximately linearly related to the degree of deviation from random guessing. In contrast, overly nonlinear transformations may introduce additional noise or distort the underlying distributional characteristics.
22

---

Published as a conference paper at ICLR 2026
Table 17: Ablation studies the effectiveness of each module (%). Here, (0) and Pio denote the use of QualiCLIP and Topiq the Image Quality Encoder, respectively.
(T)
FreqNet"
SAFE
Average
tbs
PDT
PLCC
SRCC
PLCC
SRCC
PLOC
SRCC
PLCC
SRCC
PLCC
SRCC
PLCC
SRCC
PLCC
SRCC
78.22
93.76
87.91
97.23
94.04
86.50
94.21
91.33
86.86
81.88
92.72
86.65
95.14
81.41
95.03
90.34
97.80
94.29
94.04
90.16
95.61
92.74
88.18
82.63
94.30
88.60
98.33
93.23
91.99
91,40
97.71
90.10
97.71
95.44
98.58
95.91
97.74
95.49
98.15
95.76
96.05
91.11
97.66
93.97
Table 18: Ablation on label transformation functions for DACOM training. APT) of multi-detector fusion under different label mappings.
Performance (Acct /
Label functions
a
ID distortion
OOD distortion
Average
Worst
Linear (Ours)
95.37/99.47
92.84/98.33
93.79/98.76
84,90/93.16
Upow
(y)a
0.5
95.20/99 .1
92.46/97.78
93,49/98.39 39
82.80/90.66
Upon
(1)
2.0
95.35/99.47
92.65/98.19
93.66/98.67
84.00/92.15
ylog [og[T+a)
logt +omMaa?
3.0
95.19/99.38
92.29/97.58
93.36/98.26
82,80/90.46
Weep
3.0
94.72/99.12
92.14/97.54
93.11/98.1
16
K REPRODUCIBILITY STATEMENT
We have made every effort to ensure the reproducibility of our work. All datasets used in this paper are publicly available and the exact training/testing splits and preprocessing steps are documented in Appendix D Our proposed Distortion-Awen Aware Confidence Model (DACOM) is described in de- motivation in Section 3, methodological steps in Section training procedures in Section 4.4] and hyperparameters and implementation details in Section 5. and Appendix F To fur- ther facilitate reproduction, we will release our source code, pretrained models, and data-procsssing scripts upon publication.
tail, including
L THE USE OF LARGE LANGUAGE MODELS (LLMs)
During the preparation of this manuscript, Large Language Models (LLMs), specifically GPT-5, were employed as versatile writing and research assistants. Their primary contributions included:
Refining and Polishing Language: Improving clarity, conciseness, and grammatical ac- curacy of the text, with particular attention to academic English style and phrasing.
Formatting LaTeX Code: Supporting the generation and debugging of LaTeX code for tables, figures, and mathematical equations, thereby ensuring professional presentation and consistent formatting.
It is important to note that all core research ideas, experimental design, implementation, and inter- pretation of results were independently conceived and conducted by the human authors. The LLM was used solely tool to enhance the quality and readability of the manuscript's presentation, without contributing to the original scientific findings
23


Reviews:
[{"review_id": "nutOHVwFFw", "reviewer": "Reviewer_iFaB", "summary": "The authors propose to train a predictor for calibration-type confidence in the sense of probability of the prediction being wrong. They do this specifically for GAN-generated image detection.\n\nTo do this, they use detector features, features from a predictor of distortion type, features from a predictor of no-reference image quality, and use this with an MLP on top to predict the confidence via regression.\n\nThey perform experiments on correlation between the predicted and the true calibration, they show the usefulness of the predictor for top-1 routing to GAN-generated image detectors, and for confidence based vote abstention, evaluated by a ranking measure.", "questions": "none", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "- They perform experiments beyond just training the calibrator. \n    - It shows its usability for top-1 routing and for vote abstention / or low confidence flagging.\n- if one would want to hide the fact that an image was generated by a deep learning model, then image distortions are a natural candidate for obfuscation, so the setting makes sense\n- Clear idea \n- well readable paper", "weaknesses": "- it has not the greatest novelty, it is not what one would think has to be shown as an oral\n- The dataset used for the main experiments, PROGAN. is from the pre-diffusion model era. \n\nIt would be better to see the results for distortions also for diffusion datasets. They do this for the cross-evaluation in section 5.4 but it would be good to have done it also for section 5.3 and also for the confidence evaluation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ottrSsBI5M", "reviewer": "Reviewer_DcA6", "summary": "Conventionally, fake image detectors assign a real/fake label. However, detecting these fake images in the wild involves dealing with post-processing operations modify the original signal and hence affect their detection. The authors try to develop an effective method through which one can also predict the confidence of the detector. This is especially challenging since, neural networks are not well-calibrated. In order to do this, the authors leverage image quality to measure the confidence. The change in image quality, depends on the reference image, which is conventionally not available during test time, in order to predict this, the authors train the neural network to do so. Experiments show improved calibration and the authors also show how this can be used in effectively detecting fake images.", "questions": "1. Does the method currently account for multiple distortions, if not can it be made to account for this case?\n2. For the training, why does equation 7 use MSE loss as opposed to the binary cross entropy loss?", "limitations": "", "rating": 6, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The problem of uncertainty estimation in fake image detection is both interesting as well as practically relevant. It is also an understudied problem.\n2. The focus of the study on distortions also makes the paper practically relevant.\n3. Multi-Detector Routing and Confidence-Based filtering are good use cases for the method.", "weaknesses": "1. The experiment reported in section 3 would benefit from the inclusion of more details. For instance, what is the data used, what is the amount to which each post-processing operation is applied, etc. \n2. My main concern comes from the fact that the existing method seems to only account for single distortions. However, one can compose distortions (resize first, then blur later for instance). It is currently unclear to me as to how the method would work given these settings. \n3. The limitations should be discussed with further detail. The issues that the current method has with respect to data coming from different sources would be interesting and insightful to the community.\n4. The plots have extremely small text and it can be hard to follow, it would be better if the text in the plots are much bigger than they currently are. Especially for the plots in the appendix and Fig 2.\n\nMinor Weaknesses\n1. Line 42-43: This statement is not correct. A lot of detectors use common post-processing operations as part of their training [1,2].\n\nReferences,\n1. Wang, S. Y., Wang, O., Zhang, R., Owens, A., & Efros, A. A. (2020). CNN-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition (pp. 8695-8704).\n2. Gragnaniello, D., Cozzolino, D., Marra, F., Poggi, G., & Verdoliva, L. (2021). Are GAN generated images easy to detect? A critical analysis of the state-of-the-art. arXiv preprint arXiv:2104.02617.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "hQlOUvzV0A", "reviewer": "Reviewer_5Ewd", "summary": "This paper addresses the problem that forensic detectors for AI-generated images produce predictions without indicating reliability when test images undergo various distortions such as compression and noise. The authors propose DACOM (Distortion-Aware Confidence Model), which uses full-reference image quality assessment metrics to label training data with detectability scores during training, then learns to predict sample-level confidence using detector features, no-reference image quality descriptors, and distortion-type information at inference time.", "questions": "1. The formula y = 2×|BAcc - 0.5| assumes equal difficulty in improving accuracy across the entire range (e.g., 50%→75% vs. 75%→100%). However, achieving near-perfect accuracy is typically much harder than reaching moderate levels, suggesting a non-linear relationship.\nHave you experimented with non-linear transformations (e.g., y = (2×|BAcc - 0.5|)^α with α > 1, or logarithmic scaling) that better reflect the diminishing returns at higher accuracy? Alternatively, why not use BAcc directly as labels without transformation? An ablation study comparing different label functions would clarify whether this linear design is optimal or just a convenient choice.\n\n2. You train four DACOM variants with different FR-IQA metrics (Table 6) and all perform similarly. Does this mean the choice of FR-IQA is not critical? If so, why present four variants instead of selecting one? What guidance do you offer to practitioners on choosing the FR-IQA metric?\n\n3. What is the parameter count and FLOPs of DACOM? Since it must run alongside the detector, efficiency matters. How does DACOM's overhead compare to the detector itself (e.g., DACOM adds X% latency)?", "limitations": "", "rating": 6, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. The paper's motivation and perspective are well-founded and novel. Few existing works approach AI-generated image detection from the lens of image quality assessment to evaluate detector reliability under distortions. This angle provides a fresh and meaningful contribution to the forensics community.\n2. The paper is well-organized with clear logical flow. The authors systematically progress from problem identification (Section 3 analysis) to method design (Section 4), making the work easy to follow. The empirical analysis establishing the correlation between FR-IQA scores and detection accuracy provides solid justification for the proposed approach.\n3. The experimental evaluation is comprehensive and thorough. The authors provide extensive ablation studies (Section 5.5), test on multiple distortion types (both seen and unseen), evaluate across different datasets (Evaluation-dataset and Cross-dataset), and include detailed supplementary results in the appendix, all of which substantiate their claims with adequate evidence.", "weaknesses": "1. Concerns regarding the use of detector performance for labeling in Stage A. The authors use the detector's balanced accuracy on each bin to generate detectability labels (Equation 3-4). This raises several concerns: (a) If FR-IQA scores already exhibit monotonic correlation with detection performance (as shown in Section 3), why is the additional step of computing detector accuracy necessary? Could the FR-IQA scores themselves serve as supervision? (b) More critically, this design may limit generalizability—if training data is labeled using Detector A's performance, will DACOM trained on this data generalize well to Detector B? This detector-specific labeling could hinder practical deployment across different detection models. (c) The requirement to evaluate detector performance on large distorted datasets during Stage A significantly increases the computational cost of the training pipeline.\n2. Limited discussion on robustness training and its interaction with the observed monotonicity. The authors address distortion robustness by applying light data augmentation (10% JPEG compression and blur) during detector training. However: (a) Only two distortion types are used for augmentation, which seems insufficient given the diversity of real-world distortions. (b) It remains unclear whether the monotonic relationship between FR-IQA and detection accuracy (Section 3) still holds when detectors are trained with more aggressive data augmentation strategies. If extensive augmentation flattens the performance curve across distortion levels, would DACOM's premise still be valid? This interaction between robustness training and the proposed method deserves further investigation.\n3. Limited training data scale may restrict generalization. The model is trained on only 2,500 base images from a single dataset (ProGAN subset). While distortion augmentation expands this to 200K+ samples, the underlying content diversity remains limited. This could lead to: (a) Overfitting to the specific visual patterns in these 2,500 images. (b) Poor generalization to different content types, as evidenced by the noticeable performance drop in Cross-dataset evaluation (Table 4). Experimenting with larger and more diverse training sets would strengthen the claims about generalizability.\n4. The proposed applications have practical limitations that merit further exploration. While the paper demonstrates two uses of DACOM—selective filtering and multi-detector routing—both have notable drawbacks: (a) Selective abstention necessarily reduces coverage, which may be unacceptable in applications like content moderation where all samples must be processed. (b) Multi-detector routing requires maintaining and running multiple detectors (6× computational cost in experiments), which may be prohibitively expensive for real-time systems. I suggest the authors explore alternative applications that leverage DACOM more seamlessly, such as incorporating confidence-aware calibration directly into a single detector's training or inference process, or using confidence scores to dynamically adjust decision thresholds rather than completely abstaining from prediction.\n\nOverall assessment: Despite these concerns, I view this as a valuable contribution that introduces a novel perspective on detector reliability. If the authors can adequately address the above concerns—I would be inclined to raise my score.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jWqtMqKI3p", "reviewer": "Reviewer_2NT5", "summary": "This paper proposes DACOM, a neural regressor that predicts the probability that a given forensic detector will correctly classify a (possibly distorted) image. The key insight is that FR-IQA scores correlate monotonically with detector accuracy conditioned on distortion type. Training labels are obtained by bucketing FR-IQA scores per distortion type and mapping bin-wise balanced accuracies to [0,1]. At inference DACOM uses detector features, NR-IQA features and a distortion-type embedding to estimate sample-level confidence without references. The score enables “selective abstention’’ and “top-1 routing’’ among detectors and improves overall accuracy on several benchmark.", "questions": "1. How would the results change if Balanced Accuracy is replaced with AUC-PR or F1 measures?\n2. Please report the inference overhead of DACOM and compare it to baselines.\n3. Please add more discussions about ethical aspects. \n4. Minor issue: Text in Fig. 2 and Fig.6 is tiny, please enlarge.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "1. The paper introduces a novel framework that tackles reliability estimation, which is orthogonal and complementary to existing works.\n2. It provides a principled, detector-conditioned confidence definition and a practical solution that avoids requiring reference images at test time.\n3. Extensive experimental validation on diverse detectors and a broad spectrum of distortions is conducted. Ablations clearly show each component’s contribution.\n4. The paper is well written and easy to follow.", "weaknesses": "1. Evaluations rely mainly on Balanced Accuracy and EER. In practice, real and fake samples are imbalanced. Would precision-recall–based measures (e.g., AUC-PR, F1) change the conclusions?\n2. The inference pipeline runs QualiCLIP, ARNIQA and the detector for every input may be costly on edge devices. A detailed analysis of timing/FLOPs is missing. \n3. While abstention can improve safety, it also off-loads decisions to human operators and potentially offers adversaries a mechanism to trigger systematic abstention. The paper lacks discussion of these risks and possible mitigations.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)