No Pixel Left Behind: A Detail-Preserving Architecture for Robust High-Resolution AI-Generated Image Detection
Authors: Lianrui Mu
Haoji Hu
Zou Xingze
Jianhong Bai
Jiaqi Hu
Venue: ICLR 2026 Poster (2026)
Keywords: AIGI detection
High-Resolution detection
Featrue aggregation
Primary area: applications to computer vision, audio, language, and other modalities
TL;DR: We propose HiDA-Net, a detector for high-resolution AI-generated images that leverages all input pixels by integrating global context with local tile features, achieving 13% gain on challenging Chameleon benchmark.

Abstract: The rapid growth of high-resolution, meticulously crafted AI-generated images poses a significant challenge to existing detection methods, which are often trained and evaluated on low-resolution, automatically generated datasets that do not align with the complexities of high-resolution scenarios. A common practice is to resize or center-crop high-resolution images to fit standard network inputs. However, without full coverage of all pixels, such strategies risk either obscuring subtle, high-frequency artifacts or discarding information from uncovered regions, leading to input information loss. In this paper, we introduce the **H**igh-Resolution **D**etail-**A**ggregation Network (**HiDA-Net**), a novel framework that ensures no pixel is left behind. We use the Feature Aggregation Module (FAM), which fuses features from multiple full-resolution local tiles with a down-sampled global view of the image. These local features are aggregated and fused with global representations for final prediction, ensuring that native-resolution details are preserved and utilized for detection. To enhance robustness against challenges such as localized AI manipulations and compression, we introduce Token-wise Forgery Localization (TFL) module for fine-grained spatial sensitivity and JPEG Quality Factor Estimation (QFE) module to disentangle generative artifacts from compression noise explicitly. Furthermore, to facilitate future research, we introduce **HiRes-50K**, a new challenging benchmark consisting of **50,568** images with up to **64 megapixels**. Extensive experiments show that HiDA-Net achieves state-of-the-art, increasing accuracy by over **13%** on the challenging Chameleon dataset and **8%** on our HiRes-50K.

Published as a conference paper at ICLR 2026
No PIXEL LEFT BEHIND: A DETAIL-PRESERVING ARCHITECTURE FOR ROBUST HIGH-RESOLUTION AI- GENERATED IMAGE DETECTION
Lianrui Mu, Haoji Hu; Xingze Zou, Jianhong Bai, Jiaqi Hu Zhejiang University fmuliance ianrii, jaoji hu, zeezou, jianhongbai, jiaqi hu edu. en
ABSTRACT
The rapid growth of high-resolution, meticulously crafted Al Al-generated images poses significant challenge to existing detection methods, which are often trained and evaluated on low-resolution, automatically generated datasets that do not align with the complexities of high-resolution scenarios. A common practice is to resize or center-crop high-resolution images to fit standard network inputs. However, without full coverage of all pixels, such strategies risk either obscuring subtle, high-frequency artifacts or discarding information from uncovered regions, lead- ing input information loss. In this paper, introduce the High-Resolution Detail-A Aagill-ggregttion Network (HiDA-Net), a novel framework that ensures no pixel is left behind. We use the Feature Aggregation Module (FAM), which fuses features from multiple full-resolution local tiles with a down-sample global view of the image. These local features are aggregated and fused with global representa- tions for final prediction, ensuring that mative-resolution details are preserved and utilized for detection. To enhance robustness against challenges such as localized AI manipulations and compression, we introduce Token-wise Forgery Localiza- tion (TFL) module for fine-grained spatial sensitivity and JPEG Quality Factor Estimation (QFE) module to disentangle generative artifacts from compression noise explicitly. Furthermore, to facilitate future research, we introduce HiRes- 50K, new challenging benchmark consisting of 50,568 images with up to 64 megapixels. Extensive experiments show that HiDA-Net achieves state-of-the- art, increasing accuracy by over 13% the challenging Chameleon dataset and 8% on our HiRes-50K.
INTRODUCTION
The rapid advancement of Al-generated image (AIGI) technologies, particularly diffusion models proposed in recent works Sich--Dicsttein et al., 2015; Ho al., 2020; Dhariwal & Nichol [021] Podell et al. 2023 Rombach et al.] 2022), has led to surge in the generation and sharing of hyper- realistic, high- resolutsotttion images online. Unlike the outputs of early generative models (Mirza & Osindero 2014 Karras et al.) 2017), generated images on social platforms are often carefully se- lected, edited, or even upscaled by users (Saharia et al. [202]). making them nearly indistinguishable from real photographs to the human eye (Kamali et al. 2025). This new reality poses significant risks to information authenticity (Ferreira et al. 20200), societal trust, and copyright protection (Ren et al.) 2024). making the development of robust detectors for high-resolution generated images priority.
Despite significant strides in AIGI detection (Wang et al. 20200 Frank et al.) 2020 Ojha et al. 2023), the generalization ability of existing methods has notably degraded modern, high-resolution benchmarks like the Chameleon dataset (Yan et al., 2024a). We attribute the performance collapse to two key challenges: Input Degradation and Limited Generalization.
Input Degradation. A primary cause for the failure of current detectors on high-resolution images an architectural bottleneck. Most frameworks resize large inputs fixed, low resolution (e.g..
224 x 224) to fit standard backbones (Ojha et al. 2023 Tan et al. 2024a Liu et al. 2024 Tan et al.
"Corresponding author: Haoji Hu.

---

Published as a conference paper at ICLR 2026
2025 As shown in Sec. 3 resizing introduces strong low-pass effect, inreversibly erasing the subtle, high- seehfrrquency fingerprints that are most indicative of Al-generated artifacts. While some methods attempt to mitigate this by cropping limited regions, such as TextureCrop's region selection approach (Konstantinidou et al. 2025) or SAFE's center-cropping (Li et al. 2024), they only analyze few selected regions. This partial analysis discards potentially crucial evidence from the rest of the image. We argue that truly comprehensive analysis requires systematically examining the entire image at its native resolution ensure no detail is overlooked.
Limited Generalization. As research (Zheng al., 2024) has shown, models can learn "shorteuts" by overfitting to dataset-specific cues, such as the generation source model or generation prompts, rather than universal syn- thetic artifacts. This problem is severely ex- acerbated by mismatched JPEG compression histories between real and fake images, which teaches the model to become compression de- tector rather than a synthesis detector (Grom- melt et al., 2025). While naive JPEG augmen- tation offers partial relief, often fails to gener- alize to unseen compression levels. Morcover, the rise of localized forgeries like Al-driven in- painting demands that detectors possess fine- grained spatial awareness to identify manipu- lated regions within otherwise authentic high- resolution images (Chen et al.) 2024)), posing significant challenge for models trained solely on datasets with fully synthesized images.
Previous
Ours
Resize
Crop Only
FAM
QFE
information
Clacsitien
Real/Fake
Reat/ake
Figure 1: Comparison between our model and previous approaches. Many existing methods ei- ther resize high-resolution images to fit a visual backbone or crop only the central region. In con- trast, our method processes full-resolution tiles covering the entire image, preserving fine-grained details and utilizing all pixel information for more accurate detection on high nigh-resolution images.
To address these multifaceted challenges, introduce the High-Resolution Detail- Aggregation Network (HiDA-Net), a frame- work designed for comprehensive and robust detection of high-resolution Al-generated im- ages. As illustrated in Fig. [ as a series of full-coverage, native-resolution tiles. It utilizes novel Feature Aggregation Module (FAM) to fuse features from these local tiles with a global contextual view, ensuring no pixel is left behind. To combat shortcut learning and enhance generalization, we incorporate two extra training tasks. Token-wise Forgery Localization (TFL) endows the model with fine- greiggri spatial aware- ness to pinpoint manipulated regions, making it robust against localized forgeries like inpainting. And the JPEG Quality Factor Estimation (QFE) module, utilizing the preserved pristine JPEG artifacts within each crop tiles, forces the model to disentangle generative traces from compression noise, enhancing the robustness facing JPEG compression. To facilitate rigorous and realistic evalu- ation, also present HiRes-50K, new challenging benchmark of 50,568 high-resolution images (up to 64 megapixels) with carefully aligned compression distributions and image sizes. Our main contributions
HiDA-Net avoids input downsampling by processing the entire image
A Novel Detail-Preserving Architecture: We propose HiDA-Net, a network that pro- cesses full-coverage, native-resolution tiles to prevent information loss. Its key compo- nents: the Feature Aggregation Module (FAM), Token-wise Forgery Localization (TFL), and JPEG Quality Factor Estimation (QFE), work in synergy to achieve robust, detail- aware detection on high-resolution images.
A New High-Resolution Benchmark: We introduce the HiRes-50K dataset, featuring 50,568 images of up to 64 megapixels with paired sizes and JPEG compression levels, providing a more realistic and challenging benchmark for future research.
State-of-the-Art Performance: HiDA-Net establishes a new state-of-the-an across multiple benchmarks, demonstrating significant gains of over 13% on the challenging Chameleon dataset and over 8% on our HiRes-50K, proving its superior robustness and generalization.
2

---

Published as a conference paper at ICLR 2026
2
RELATED WORKS
2.1 EXISTING FEATURE EXTRACTION METHODOLOGIES
Existing detection methods differ in how they process input images to extract features related to synthetic content. Early approaches utilized traditional CNNs (Wang al. 2020 Liu al. 2020).
while more recent works have leveraged pretrained vision-language or modern CNN models to capture global image inconsistencies (Liu et al., 2022). For example. UnivFD (Ojha et al., 2023) constructs a linear classifier using frozen CLIP features (Radford et al. 2021), while C2P-CLIP fine- tunes the model with carefully designed prompts (Tan et al. 2025). These resizing-based methods tend to suppress high-frequency components and degrade detection performance. To prevent this in- formation loss, another line of research analyzes low-level features. Methods like PatchCraft (Zhong et al. 2023a) and AIDE (Yan et al. 2024a) propose strategies to select the most informative patches based on Texture or frequency content. Similarly, TextureCrop (Konstantinidou et al.) 2025) and SAFE (Li et al. 2024) demonstrated that cropping improves performance. However, these methods typically focus on limited regions, overlooking valuable information from the global context. B-Free processes multiple crops independently and obtains the final prediction by simply averaging their results (Guillaro et al.) (025). Our HiDA-Net addresses this by integrating local high-frequency details from all image tiles with global context an end-to-end architecture.
2.2 RECONSTRUCTION-BAN BASED DETECTION
Reconstruction error provides a strong detection signal. DIRE detects diffusion- geeerirtd images by first applying diffusion-based noise and denoise reconstruction process, then computing the residual between the original and reconstructed image, which is used as input to a trainable classi- fier (Wang al. 2023). Follow-up work simplifies this idea. Aeroblade finds that the pretrained autoencoder (AE) from a latent diffusion model alone reconstructs generated images with lower error than real ones, avoiding the costly denoising process (Ricker al. 2024). DRCT operational- izes this by using diffuusion-reconstruutee real images as fake images in a contrastive framework, encouraging the model learn subtle distinctions between real images and visually similar recon- structions (Chen et al. 2024). Rajan et al. (2025) used an autoencoder to construct paired training data. B-Free also uses self-conditioned reconstructions and content-awar inpainting of real images to construct biauereduced paired training data (Guillaro et al., 2025). Inspired by this philosophy, we leverage VAE-based reconstructions and a randomized patch swap strategy to generate partially manipulated images with token-level labels, which we couple with our Token-wise Forgery Local- ization (TFL) objective to sharpen spatial sensitivity to localized edits.
2.3 GENERALIZATION ABILITY RESEARCH FOR DETECTION
Real world images undergo diverse degradations (e.g., JPEG recompression, resizing, blur), posing significant challenges detector robustness. A common practice is to augment training data with different distortions (Wang et al., 2020: Yan et al. 2024a), yet this may teach the model tolerance to artifacts rather than distinguishing them from synthesis traces. Recent analyses reveal deeper biases that detectors often exploit dataset biases such as mismatched compression histories (Grommel) al. 2025) or superficial distributional signals tied source models or prompt styles (Zheng al., 2024.. hindering generalization beyond curated benchmarks. To mitigate these issues, we introduce a JPEG Quality Factor Estimation (QFE) task that encourages the model to separate compression noise from synthesis artifacts. We also propose HiRes-50K. high-resolution dataset in which real and fake images are aligned in both image size and JPEG compression level, allowing for more realistic and controlled evaluation.
MOTIVATION: AN
VIEW
Resizing introduces a strong low-pase pass effect that discards high-frequency cues critical for detection, while cropping preserves and redistributes this content via spectral leakage.
We compare two downsampling method on the SDv1.4 subset of GenImage: (i) resiz- ing 448x448 image to 224x224, and (ii) random cropping 224x224 patch from the
3

---

Published as a conference paper at ICLR 2026
JPEG Quality Factor
Tiree
JPEG Quality Factor
Toss
Local Aggregator
Aggregation
Cafa
Zonil
Clacs lfar
FBCNN
Fane
Global Token
Global Image
VIT Backbone
Transformer
Ouupptt
Concet
Model Input
Forgery
Localization
Crop to Model Input,
Input Image
Freeze
Trainable
Local Detail Tiles
Local Detail Token
Token Level Label
Figure 2: Overview of HiDA-Net. Input images are processed by two paths: (i) a global path that resizes I input size, and (ii) local path that crops K tiles. Both are fed into shared, frozen ViT backbone and refined by small trainable Transformer. The /CIS) tokens from all tiles are aggregated by the Feature Aggregation Module (FAM) for classification. Two tasks are trained jointly: Token-wise Forgery Localization (TFL) supervises patch tokens for localized manipulations, and JPEG Quality Factor Estimation (QFE) regresses the JPEG quality from fdemil
original. For each method, visualize the spectral energy ratio between real and gen- erated images (Fig. B) Red indicates higher energy for real images and blue indicates higher energy for generated ones. Real images exhibit stronger high-frequency components. Resizing truncates the outer regions of the frequency spectrum, removing high-frequency differences critical for detection. In contrast, random cropping retains high-frequency cues for detection.
Rusice resut resembles center spectrum
+5dB
leads high-frqquency information loss.
Resize Result
6dn
Resizing an image I is equivalent in the frequency domain to truncating its Discrete Fourier Transform (DFT), F(T), retaining only the central low-frequency coefficients, which irreversibly removes high-frequency informa- tion. When downsampling
result maintains
Spectral ratio real & fake images
Figure 3: Resizing Cropping in the Fre- quency Domain. Visualization of spectral energy differences when downsampling from 448x 448 to 224x224.
image from N₂ x N2 to M1 x M2 with an ideal low -wwssss filter, the DFT of the new image, Y [r,,, r2], is centered crop of the original DFT X [ri, r2), scaled by constant:
M1 M2 N N₂
Mi |r2|
M2
Y|n,
X(r1,r), mn
<
All figh-frequency components beyond this central region discarded.
In contrast, cropping a tile Pş from I is equivalent to multiplying by a window function Wa of width Mj and height Mz. By the convolution theorem:
Dw(w)= sin(Mw/2) sin(w/2)
J(Px) = WA = F(T) F(W.).
(2)
F(W)) = سي (it, ال
DMa, (w) (w))DMs. (w2).
(3)
where * denotes convolution. The term F(W,) a Dirichlet kernel. This causes spectral leakage, effectively spreading information from all original frequencies, including high frequencies, across the entire spectrum of the cropped tile.
non-overlapping tiles indexed by (a, b), {O.... 11011 and b {O,... n1 m1-13, 11. The (a, b)-th tile has size M! x xM(() and top-left starting coordinates ( Eisa M(1) and A Ejeb Mf4) Let Via,d) (etws edwr) be the DTFT of tile
We further consider partition of into
4

---

Published as a conference paper at ICLR 2026
(a, b). The DTFT of the full image can be reconstructed from the tiles via appropriate phase shifts:
no 1-11 m
X(elu elwe))
e-
+w2as) (ia (edws ,e
Thus, processing a sufficient set of tiles retains access to the full frequency content of the original image. Practically, we implement this by cropping tiles to cover the entire image, ensuring full- spectrum coverage. Compared with resizing, the cropped tiles collectively cover the full image and are fed into the model, preserving high-frequency information for accurate detection. The complete mathematical derivations can be found in the supplementary materials D.I
4 METHODOL.OGY
We propose the High-Resolution Detail-Aggren Agregattio Network (HiDA-Net), a dual-path detector for high-resolution images illustrated in Fig- 2 A global view provides semantic context, while a of lossless, full-resolution files covers all pixels to preserve subtle high-frequency generation cues. Both paths share a frozen ViT backbone with lightweight refinement layer. The Feature Aggre- gation Module (FAM) fuses tile-level and global [CLS] tokens for the final decision. To improve reliability in real-world conditions, we add two extra tasks: Token-wise Forgery Localization (TFL) for spatial sensitivity to localized edits, and JPEG Quality Factor Estimation (QFE) to disentangle compression artifacts from generative traces.
4.1 INPUT PREPROCESSING AND FEATURE EXTRACTION
Given input image I E #xxx3 of arbitrary resolution, we extract its features via two parallel paths:
The image / is resized the standard input dimension of our backbone network (a Vision (onnsfommrr(iiT) with 224 x 224 input), yielding a global-viee image Iglobal, which provides overall semantic information.
Global Path:
Local Path: To preserve high-frequency details, the original image I is divided into K tiles (I,, Jz..... JR each of size 224 224. These tiles are cropped directly from the source im- age without any resizing, thus maintaining pixel-level information. The tiling strategy ensures that the union of all tiles fully covers the original image.
Both the global image /global and the local tiles { k= are passed through a shared and frozen pre-trained ViT backbone. The output tokens from the VIT's final layer are then refined by a small, trainable Transformer for subsequent tasks. For a tile Ts. this produces Tj [1 1h ... ,
where t is the [CLS] token and the others are VIT image patch tokens. For the global image Iglobal we obtain Tglobal Egglohal f1 global ..... . glohal J. During training, we randomly sample K [Kmin, Kmmx] tiles to encourage robustness, and during inference, we deterministically cover the whole image to ensure no area missed.
4.2 FEATURE AGGREGATION MODULE (FAM)
We fuse global semantics and high-fidelity local details make the final classification.
Local Detailed Feature Aggregation: We collect the (CLS) tokens from all local patches to form variable length sequence {1 12 f2...... ..., }. J. A lightweight Transformer encoder Local Aggregator encodings processes this sequence. We prepared a learnable output token lour and get the aggregated
local detailed feature:
Sastall Local/Agrregator((f..r 1a.s-.... -.. [))
(5)
Global-Detail Fusion and Classification: We concatenate the global [CLS] token Felobal and faeua obtain the final discriminative feature vector finai
global
cls
final Concat (ggtaaat f
5

---

Published as a conference paper at ICLR 2026
which is fed to an MLP head to produce the binary probability p. ylue {0, indicates real/fake. The loss is:
Las CrossEntropy(pp. yuru)
4.3 TOKEN-WISE FORGERY LOCALIZATION (TFL)
We introduce the Token-win wise Forgery Localization (TFL) task to provide token-level supervision for localized manipulations. We adopt Random Patch Swap (RPS) augmentation. For given pair of real and fake images, we randomly swap proportion of the corresponding image to form composite with both real and fake regions. When image pairs are unavailable, we swap patches be- tween random real and random fake image. This augmentation yields "soft" label Moken E [0, 1] for each ViT patch token, computed as the average of binary pixel labels within the corresponding patch. See supplementary materials for more details.
For all non /CLS) tokens t from both local tile 4 and the global image Iglobal. shared linear head with a Sigmoid function predicts the token's forgery probability Pioken,i. The TFL loss Lit is the mean Binary Cross-Entropp (BCE) over all tokens:
Lu
Σ
BCE(p y Fioken.
(8)
Mootal
where Moral is the total number of patch tokens.
4.4 JPEG QUALITY FACTOR ESTIMATION (QFE)
To improve the model's robustness against JPEG compression, we introduce the QFE task, which trains the model actively perceive the degree of compression. Using the aggregated local feature fdeail. which is rich in high-frequency details most affected by compression. We regress the JPEG Quality Factor (QF) via:
Gpred MLP (LLPq()deun))
Since some training images were compressed and then saved as a lossless format like PNG, we do not rely file metadata. Instead, pre-trained estimator in FBCNN (Jiang et al. 2021 provides Qtne for supervision, and the loss is:
Lafe MSE Apreds Qarue)
(10)
This guides the model to distinguish grid-like quantization artifacts and disentangle content from compression during classification.
Overall Loss The final loss function is below, and 3 are set to in default.
Can = Lets + aL + BLqte-
(11)
5 HIRES-50K: A NEW HIGH-RESOLUTION BENCHMARK FOR AIGI DETECTION
Dataset Overview.
To evaluate detectors under realistic high- resolution conditions, we introduce HiRes- 50K, challenging benchmark of high-quality images collected from accessible AIGI commu- nities (Freepik) 2023] LiblibAI 2025 Civitai 2025 and a real-image community (Unsplash 2025). The collection complied with the Terms of Service and privacy policies each source at the time of access. Unlike datasets generated from a fixed model and a small set of prompts, HiRes-50K is built from in-the-wild Al image
3300
2300
27001
Figure 4: Samples images and resolution dis- tribution in HiRes-50K. Left; generated images. Right: image long-edge resolution distribution.

---

Published as a conference paper at ICLR 2026
Cross- accuracy (Acc) performance on the Chameleon testset. For each training dataset, the first row indicates the Acc evaluated on the Chameleon testset, and the second row gives the Ace for "fake image/real image" for detailed analysis.
Table 1:
Training Dataset
CNNSpot
FreDect
UnivED
DIRE
PatchCraft
NPR
AIDE
Ours
60.11
56.86
55.62
59.71
56.32
58.13
62.60
73.44
SD v1.4
8.86/98.63
1.37/98.57
17.65/93.50
11.86/95.77
3.07/96.35
2.43/100.00
20.33/94.38
65.47/79.44
60.89
57.22
60.42
57.83
55.70
57.81
65.77
79.10
GenImage
86/99.22
0.89/99.55
85.52/41.56
2.09/99.73
1,39/96.52
1.68/100.00
26.80/95.06 76.77/82.20
sharing platforms and manually curated include "human -aand,,, visually high-quality cases, mak- ing its distribution much closer to what detectors encounter on the real internet.
HiRes-50K includes 50,568 images spanning long-edge resolutions from below 1K over 10K pix- els, with some reaching up to 64 megapixels. For comparison, the recent Chameleon dataset com- prises only 26K images, with most long edges resolution below 1,500 pixels (Yan et al. (024a). Our benchmark surpasses it in both resolution and scale, significantly extending the evaluation boundary for high-resolution detection. As shown in Fig. HiRes-50K features diverse content including portraits, landscapes, architecture, vehicles, and animals. We divide the dataset into eight resolution subsets: [0, 900), [900, 1200), [1200, 1500), [1500, 2000). [2000, 2500). [2500, 3000), [3000, 5000), and [5000, oo), covering both common and extreme cases for stress-testing robustness.
Construction principles. We estimate the JPEG compression level of generated images and apply similar compression to low-compression real images after resizing them to match in pixel count. This process aligns real and fake images in both size and JPEG compression level within each resolution subset. Each subset maintains a 1:1 balance between real and fake images.
EXPERIMENT
6.1 IMPLEMENTATION DETAILS
Input Tile Split We use the pre-trained CLIP ViT-L/14 model as the backbone (Radford et al. 2021) We set the cropping resolution to 224 x 224 to align with the input resolution. Images with either side less than 224 are resized to 224 the shorter side with preserved aspect ratio before applying tile cropping and augmentation. Other images keep their original resolution. During training, we randomly crop I to 16 tiles from one input image. During inference, we adopt a full-coverage tiling strategy. Specifically, if the input image has length L along spatial dimension and the tile size is P. we generate N [L] tiles along that dimension. The starting position of the i-th tile is:
L N
(1 (0-1)
for i = 1,2...,,NNI -
(12)
and the last tile starts at ZN = L P. This ensures that the entire image is fully covered without missing any pixels.
Data Augmentation We adopt data augmentations including random JPEG compression (QF~ U60, random Gaussian Blur (a ~ (O..1, random scaling (scale factor~ U0.25 2)) and Random Patch Swap augmentation (Swap ratio~ (0.2, 0.98)) to improve robustness. Each augmentation is conducted with 10% probability. Inspired by prior works (Rajan et al., 2025 Chen cet al. 2024), synthesize paired fake images on certain benchmarks using the VAE of diffusion model that was used to generate the corresponding training data, which helps improve performance.
6.2 COMPARISON WITH STATE-OF-THE-AN METHODS
We conducted cross-model experiments on four different datasets to evaluate the generalizability of method. Aceuracy (ACC) is calculated using threshold of 0.5.
Comparisons on Chameleon The Chameleon dataset poses a significant challenge for AIGI detec- tion due to its high-resolution and visually indistinguishable synthetic images. As shown in Table the previous SOTA method achieves only 65.77% accuracy (Yan et al., 2024a), with most exist- ing methods achieving results below 60%, indicating limited discriminative capacity under such
7

---

Published as a conference paper at ICLR 2026
Table 2: Cross-model accuracy (Acc) performance on our HiRes-50K Dataset.
Resolution Kange
(-300
900-1200
1200-1500
1500-2000
20X0-2500
2500-3000
3000-50000
25000
Avg
CNNSpol Wang et al 2020
58.46
56.37
58.73
63.14
67.42
60.90
66.30
58.90
61.28
FreDect Frank
63.67
55.63
57.31
58.16
67.78
57.23
51.06
59.72
Univ min
4024
00
58.35
62.20
65.95
66.05
58.20
58.15
60.05
62.05
DIRE Wany
59.11
64.25
62.10
66.66
75.84
63.40
69.31
62.18
65.36
AIDE Yan al 2024a
65.87
57.29
49.90
58.23
$1.88
65.31
61.04
42.16
56.46
DRCTChie ef 2024
65.30
66.19
68.78
68.85
68.78
75.79
69.65
54,03
67.17
TextuneCspp Kuastsppppaaattitt Konstentmmoo al. 2025
57.45
52.81
59.83
63.17
65,31
55.56
70.65
69.49
60.67
RINE
Koutlis rapsaiooolos 2024
65.21
60.30
63.60
63.02
58.60
61.30
61.87
63.77
62.21
SPAI
[AAlkirggennn Kirggeorgou erah 2025
79.76
74.01
73.72
71.80
65.
69.31
64.41
Ours
82.98
81,39
78.16
78,99
88.26
80,18
82.88
69.84
80.33
Table 3: Cross- accuracy (Ace) performance on the Genlmage Dataset.
Method
Midjoumey
SDv1.4
SDv1.5
ADM
GLIDE
Wukong VQDM
BigGAN
Avg
Swin-1 Liu et
[202T
62.1
99.9
99.8
49.8
67.6
62.3
57.6
CNNSpot Wang
2220
52.8
96.3
95.9
50.1
39.8
78.6
53.4
46.8
64.2
Spec Zhang cl al. 2019
52.0
99.4
99.2
49.7
49.8
94.8
55.6
49.8
68.8
F3Net Quan et al. 2020
50.1
99.9
99.9
49.9
50.0
99.9
49.9
49.9
68.7
UnivFD cf 2023
93.9
96.4
96.2
71.9
85.4
94.3
81.6
90.5
88,5 8
NPR Tan al. 2024b
81.0
98.2
97.9
76.9
89.8
96.9
84.1
84.2
6
FreqNet Tan et al.
2024a
89.6
98.8
98.6
66.8
86.5
97.3
75.8
81.4
86.8
FatFormer Liui cl 2024
92.7
100.0
99.9
75.9
88.0
99.9
98.8
55.8
88.9
DRCT Chen el al 20
91.5
95.0
94.4
79.4
89.1
94.6
90.0
81.6
89.4
AIDE Yan of al 2024A
79.4
99.7
99.8
78.5
91.8
98.7
80.3
66.9
86.8
Effort Yan et 20024b
82.4
99.8
99.8
78.7
93.3
97.4
91.7
77.6
91.1
SAFE Li et 2024
95.3
99.4
99.3
82.1
96.3
98.2
96.3
97.8
95.6
OLP Tan et al.
2025
88.2
90,9
97.9
96.4
99.0
98.8
96.5
98.7
95.8
Ours/No VAE
97.8
98.4
98.3
86.2
98.0
98.4
95.6
96.2
96.1
Ours/SDv1.4
94.2
99.1
99.2
92.7
99.1
98.0
96.9
97.8
97.1
a high-resolution scenario. In contrast, our proposed HiDA-Net, specifically expert in handling high-resolution inputs, delivers substantial performance improvements. Notably, even when trained exclusively on the SD v1.4 subset, HiDA-Net outperforms competing methods trained on the entire Genlmage dataset, while maintaining balanced accuracy across both real and generated samples. When trained on the full Genlmage dataset, HiDA-Net achieves an accuracy of 79.10%, outper- forming the previous best by a substantial margin of 13%.
Comparisons on HiRes-50K. To evaluate performance under challenging high-resolution condi- tions, we conduct experiments on our HiRes-50K dataset. All models are trained on the full Gen- Image training sets and evaluated HiRes-50K. Results are summarized in Table [ Our method consistently outperforms all competing approaches. Relative to the input-resizing baseline, it yields an average gain of 13.16%. %. Compared with TextureCrop (Konstantinidou et al. 2025), which also crops inputs but selects only limited regions and averages the predictions every tile, shows improved performance at higher resolutions. The recent SPAI (Karageorgiou et al. (225)) method exhibits a gradual performance drop as dataset resolution increases, whereas our approach remains more stable and achieves results show our method's scalability and robustness.
8% performance gain compared to SPAI on average. Experiment
Comparisons on GenImage Our method achieves consistently strong performance across both high-resolution and standard low-resolution benchmarks. Following the evaluation protocol of PatchCraft (Zhong al. 2023a), all models are trained the GenImage SD v1.4 subset and eval- uated on the full Genlmage dataset. As reported in Table 3 our approach yields results comparable the current SOTA, C2P-CLIP (Tan et al., (025). on individual subsets and surpasses it in terms of average accuracy. Moreover, incorporating fake-real image pairs synthesized by the SD v1.4 VAE further boosts performance by 1. 1.3%, achieving new SOTA.
Comparisons on DRCT. All models are trained on the DRCT SD v1.4 subset and evaluated on all testsets. As shown in Table. 4 DRCT achieves high accuracy by reconstructing each training image to form paired hard examples and applying contrastive training, which reveals subtle diffusion artifacts. Our plain HiDA-Ne Net surpasses the DRCT with SD v1.4 reconstruction but falls short the SD v2 variant. But by adopting similar strategy, construct paired training data with the SD v1.4 VAE, matching each real image to a subtly different synthetic counterpart, and apply Random Patch Swap (RPS) augmentation. The resulting model performs strongly, especially for high-resolution
8

---

Published as a conference paper at ICLR 2026
Table 4: Cross-model accuracy performance on the testing subsets of DRCT. See supplementary materials for more comparison.
Method
LDM SDV1. SDv1.5 SDv2
SDXL
Reliner
Turbo
Turbo
SDv1.5
LCM
SDXL
LCM
SDv1
Ctll
SDv2 Cul
Cul
DR
SDv2
DR
SDXL DR
Avg
CNNSpot
99.9
99.9
99.9
97.6
66.3
86.6
86.2
72.4
98.3
61.7
98.0
85.9
60.9
51.4
50.3
81.1
F3Net
99.9
99.8
99.8
88.7
55.9
87.4
68.3
63.7
97.4
55.0
98.0
72.4
82.0
65.4
50,4
50.3
77.1
Conv-B
99.9
100.0
99.9
95.8
64,4
82.0
80.8
60.8
99.2
62.3
99.8
83,4
73.3
61.7
51.8
50.4
79.1
UnivED
98.3
96.2
96.3
93.8
91.0
93.9
86.4
85.9
90.4
89.0
90.4
81.1
89.1
52.0
51.0
50.5
83.5
DRCT/SDD1.4
99.9
99.9
99.9
96.3
83.9
85.6
91.9
70.0
99.7
78.8
99.9
95.0
99.9
95.4
75.4
90.8
DRCT/SDD2
99.7
98.6
98.5
99.9
96.1
98.7
99.6
83.3
98.5
93.8
96.7
99.9
97.7
93.9
99.9
90.4
96.6
Ours/No VAE
98.7
98.8
98.8
98.7
98.8
98.8
97.7
97.6
98.6
98.8
98.8
98.4
98.2
90.4
74.8
71.2
94.8
Ours/SDv14
98.8
98.9
98.9
98.0
99.0
98.8
98.5
98.8
98.4
98.9
98.5
98.7
98.4
99.0
97.4
94.9
98.4
Table 5: Cross-model AUC performance on mixed test set.
Image Size
<. 0.5 MPixels
0.5 1.0 MPixels
1.0 MPixels
Approach
Glide SDL33
SD144 Flux DALLE2
SD2 SDXL SD3
GigaGAN MJv5
MJJv.11 DALLE3 Firefly
Fusing
63.0
62.8
62.2
57.5
76.7
62.1
38.8
80.4
64.0
74.0
25.2
76.3
LGrad
76.5
82.4
83.4
74.9
85.7
60.7
70.2
12.7
89.9
69.2
79.6
30.0
42.0
65.9
UnivFD
63.3
80.8
81.2
36.3
91.4
84.3
78.3
28.6
86.2
57.1
60.5
31.0
95.5
67.3
GramNet
78.2
83.9
84.3
78.6
85.2
66.7
77.8
19.2
85.0
63.8
84.9
42.9
38.0
68.4
DeFake
86.1
64.2
63.6
90.5
41.4
66.2
52.3
87.7
71.7
67.0
87.5
93.3
39.4
70.1
PatchCraft
78.4
95.7
96,2
86.9
81.8
95.7
96.7
33.8
98.0
79.0
96.1
28.1
79.1
80.4
DMID
73.1
100.0
100.0
97.2
54.3
99.7
99.6
67.9
67.9
99.9
94.4
41.3
90.2
83,5
RINE
95.6
99.9
99.9
93.0
93.0
96.6
99.3
39.1
92.9
96.4
81.2
41.8
82.9
85.5
SPAI
90.2
99.6
99.6
83.0
91.1
96.5
97.4
75.9
85.4
94.5
84.0
90.2
96.0
91.0
Ours
99.4
99.6
99.6
88.1
91.2
96.8
98.5
45.6
95.1
92.6
90.6
80.6
89.4
89.8
SDXL images at 1024 x 1024 and DR variants (partially inpainted images), achieving a state-of- the-art average accuracy of 98.4%.
Comparisons on Mix Set. Following SPAI (Karagcorgiou et al. 2025 we train our model on a single latent diffusion model (Rombach et al. 2022) and evaluate AUC on the same Mixed Set. Our method consistently outperforms other baselines and is only 0.2% below SPAL. Although the maxi- mum resolution Mix Set is just above megapixel, the higher-resolution Hires-50K dataset our approach exceeds SPAI by over 8% in ACC, underscoring its advantage on high-resolution images.
6.3 ROBUSTNESS & ABLATION STUDY
Table 6: Ablation study on the number of crop tiles in FAM.
Table 7: Ablation study of TFL and QFE tasks GenImage.
Tile Nums
2
16
FAM
Module
FAM
FAM+TFL
FAM+QFE
ALL
ACC
92.14
93.34
95.63
95.66
95.89
96.10
(S)
93.92
94.36
94.73
96.10
Robustness Evaluation We conducted series of experiments to assess the robustness of method against common image perturbations. We trained our model on the SD v1.4 subset of Gen- Image and evaluated it under various perturbations, including JPEG compression, Gaussian blur, and image scaling, and the results are summarized in Fig. 5 We also examine the effect of Gaussian noise perturbations, and report the results in Table
For JPEG compression, we evaluate robustness in two settings: testing on the SD v1.4 subset and on the entire Genlmage test set. For Gaussian blur and scaling perturbations, evaluations are performed on the SD v1.4 4 subset only. This broader evaluation shows that our method generalizes well across varying compression levels and datasets. In all cases, our method demonstrates strong resilience, maintaining high accuracy under moderate degradation. These results validate the robustness and generalization capabilities of our approach in real-world conditions.
Effeet of FAM Module We conduct an ablation study on the number of cropped tiles sent to the FAM module during both training and inference. Evaluation uses the same settings as comparisons on the Genlmage. We evaluate fixed sampling strategies with n = 1, a single center crop is used when inference. For other cases, tiles are randomly sampled during both training and inference. In contrast, FAM Module samples 1-16 tiles during training
{1, 4, 8, 16) tiles. When

---

Published as a conference paper at ICLR 2026
Table Model accuracy against Gaussian noise perturbation on Genimage dataset.
Table Ablation study of Global and Local branches.
Noise Std
0.002
0.004
0.006
0.008
Module
Global
No Local
ALL
ACC (%)
96.10
94,95
92.65
89.92
0.8877
88.23
ACC (%)
94,75
91.88
96.10
100
100
100
100
96
135
Accuracy (%)
85
185
80
80
80
180
-0- Own
75
75
BRST
100
90
80
70
100
90
0.5
1.5
2.5
0.8
0.8
1.0
1.2
1.4
JPEG Quality SDv14
JPEG Quality all Genimage
Blur Sigma
Resize Scale Factor
Figure 5: Model Accuracy Against Diverse Perturbation.
and uses a full-coverage crop during inference. As shown in Table. 6 increasing the number of tiles leads to better performance. FAM's full-coverage strategy achieves the best performance, validating that aggregating more high-frequency tiles benefits detection. In the FAM module, both the local and global tiles play crucial roles, and their combination yields the best overall performance on the Genlmage dataset, as shown in Table The global tiles provide a holistic, image-level context that cannot be captured by any single local region, whereas the local tiles are better suited for modeling fine-grained spatial details and therefore perform particularly well at higher input resolutions.
Effectiveness of TFL and QFE We ablate the effects Token-wise Forgery Localization (TFL) and JPEG Quality Factor Estimation (QFE) using the same Genlmage setup. As shown in Table both modules independently improve performance, their combination achieves the best results. QFE's s impact JPEG robustness is visualized in Fig. QFE shows limited gains SD v1.4 since the model was trained and tested on the same JPEG augmented SD v1.4 data. But it greatly improves robustness the unseen Genlmage set, showing better generalization. Table 4 shows that com- bining TFL with Random Patch Swap (RPS) further enhances its sensitivity to partially inpainted fine-grained manipulations, yielding strong performance.
6.4 COMPUTATIONAL COMPLEXITY
Our proposed HiDA-Net contains 331.05M parameters, representing only modest increase over the 303.97M parameters of the VIT backbone. For an input image of resolution 224x224, the computational cost is 343.3
FLOPs
FLOPs
GFLOPs, which is approximately twice that of the cor- responding VIT backbone (162,2 GFL.Oss), since our ar- chitecture extracts both global tiles and local tiles this resolution. For higher-resolution inputs, the computa- tional cost grows approximately linearly with the number of tiles, as illustrated in Fig. 6
0000
20
40
60
80
100
Number of Tiles
Figure 6: FLOPPs vs. Number of Tiles
7 CONCLUSION & LIMITATION
In this paper, we propose HiDA-Net, a network designed to detect high-resolution Al-generated images without sacrificing fine- -gaiirdi artifacts. fuses features from full-resolution local tiles and a global context view via the Feature Aggregation Module (FAM), and introduces two addi- tional tasks: Token-wise Forgery Localization (TFL.) and JPEG Quality Factor Estimation (QFE). Our model achieves state-of-the-an performance across multiple benchmarks, with notable gains on the challenging Chameleon dataset. To support future research, we introduce HiRes-50K, a high- resolution benchmark. While HiDA-Net demonstrates strong effectiveness, key limitation is the increased inference time on large images due to tile-wise processing. Our future work will optimize tile fusion and efficiency for real-workee deployment.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGEMENTS
This work is supported by the National Natural Science Foundation of China (Grant No. U21B2004)
REPRODUCIBILITY STATEMENT
We have taken extensive measures to facilitate the reproducibility of our work. The main text and appendix provide detailed descriptions of the algorithms, optimization procedures, ablation studies, hyperparameter settings, and experimental protocols to ensure transparency.
REFERENCES
Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale GAN training for high fidelity natural image synthesis. In International Conference on Learning Representations, 2019. URL
https://epenreviee net/ www.:eeet.oonnooooo
Baoying Chen, Jishen Zeng, Jianquan Yang, and Rui Yang. Dret: Diffusion reconstruction con- trastive training towards universal detection of diffusion generated images. In Forty-first Interna- lional Conference on Machine Learning, 2024.
Civitai. Civitai Homepage.
comm 2025. Accessed: 2025-08-01.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hier- archical image database. 2009 IEEE Conference on Computer Vision and Puttern Recognition, pp. 248-255. leee, 2009.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans image synthesis. Advances in neural information processing systems, 34:8780-877 07904, 2021.
William D Ferreira, Cristiane BR Ferreira, Gelson da Cruz Júnior, and Fabrizzio Soares. A review of digital image forensics. Computers & Electrical Engineering, 85: 85:106685, 2020.
Joel Frank, Thorsten Fisenhofer, Lea Schönherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. In International conference on machine learning. pp. 3247-3258, PMLR, 2020.
Freepik. Freepik Homepage. https: hwwp///wwww.oom http::::/www..feeeee. freepik. com/ 2025. Accessed: 2025-08-01.
Patrick Grommelt, Louis Weiss, Franz-Josef Pfreundt, and Janis Keuper. Fake or jpeg? revealing common biases in generated image detection datasets. In European Conference Computer Vision, pp. 80-95. Springer, 2025.
Shuyang Gu, Dong Chen, Jianmin Bao, Fang Wen, Bo Zhang, Dongdong Chen, Lu Yuan, and Baining Guo. Vector quantized diffusion model for text-to-image synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10696-10706, 2022.
Fabrizio Guillaro, Giada Zingarini, Ben Usman, Avneesh Sud, Davide Cozzolino, and Luisa Verdo- liva. A bias-free training paradigm for more general ai-generated image detection. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 18685-18694, 2025.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-663 68510 2020.
Jiaxi Jaang Kai Zhang, and Radu Timofte. Towards flexible blind jpeg artifacts removal. In Pro- ceedings of the IEEF/CVF International Conference on Computer Vision, pp. 4997-5006, 2021.
Negar Kamali, Karyn Nakamura, Aakriti Kumar, Angelos Chatzimparmpas, Jessica Hullman, and Matthew Groh. Characterizing photorealism and artifacts in diffusion model-generaee images. In Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems, pp. 1-26, 2025.
11

---

Published as a conference paper at ICLR 2026
Dimitrios Karageorgiou, Symeon Papadopoulos, Ioannis Kompatsiaris, and Efstratios Gavves. Any- resolution ai ai-generated image detection by spectral learning. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 18717,2877,22
Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for im- proved quality, stability, and variation. arXiv preprini arXiv: 1010,006,, 2017.
Despina Konstantinidou, Christos Koutlis, and Symeon Papadopoulos. Texturecrop: Enhancing syn- thetic image detection through texture-based cropping. In Proceedings of the Winter Conference on Applications of Computer Vision, pp. 1459-1468, 2025.
Christos Koutlis and Symeon Papadopoulos. Leveraging representations from intermediate encoder- blocks for synthetic image detection. In European Conference on Computer Vision, pp. 394-411. Springer, 2024.
Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Fuli Feng. Improving synthetic image detection towards generalization: An image transformation perspective. arXiv preprint (rXiv:2408.0674: 2024.
LiblibAL. LiblibAI Homepage. https://wwxt 1iblib.aa...... art 2025. Accessed: 2025-08-01.
Huan Liu, Zichang Tan, Chuangchuang Tan, Yunchao Wei, Jingdong Wang, and Yao Zhao. Forgery- aware adaptive transformer for generalizable synthetic image detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10770-10780, 2024.
Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 10012-10022, 2021.
Zhengzhe Liu, Xiaojuan Qi, and Philip HS Torr Global texture enhancement for fake face detec- tion in the wild. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 8060-8069, 2020.
Zhuang Liu, Hanzi Mao, Chao- Yuan Wu, Christoph Feichtenhofer. Trevor Darrell, and Saining Xie. A convnet for the 2020s. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 11976-11986, 2022.
Midjoumey. Midjourney homepage, 2025.
Mehdi Mirza and Simon Osindero. Conditional generative adversarial nets. arXiv: 1784, 2014.
arXiv preprint
Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob Megrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text- sext-guided diffusion models. In International Conference on Machine Learning, pp- 16784-16804. PMLR, 2022.
Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detectors that generalize across generative models. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 24480-24489, 2023.
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01995. 2023.
Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by mining frequency-aware clues. In European conference on computer vision, pp. 86-103. Springer, 2020.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp- PmLR, 2021.
12

---

Published as a conference paper at ICLR 2026
Anirudh Sundara Rajan, Utkarsh Ojha, Jedidiah Schloesser, and Yong Jae Lee. Aligned datasets improve detection latent diffusion -generrtee images, 2025. URL htttps://axxi..
abs/2410.. 11835
Jie Ren, Han Xu, Pengfei He, Yingqian Cui, Shenglai Zeng, Jiankun Zhang, Hongzhi Wen, Jiayuan Ding, Pei Huang, Lingjuan Lyu, et al. Copyright protection in generative ai: A technical perspec- tive. arXiv preprint S4Ki:22022022333 2024.
Jonas Ricker, Denis Lukovnikov, and Asja Fischer. Aeroblade: Training-free free detection of latent diffusion images using autoencoder reconstruction error. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pp. 9130-9140, 2024.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-106955 2022.
Chitwan Saharia, Jonathan Ho, William Chan, Tim Salimans, David J Fleet, and Mohammad Norouzi. Image super-resolution via iterative refinement. IEEE transactions on pattern anal- ysis and machine intelligence, 45(4):4713-4726, 2022.
Zeyang Sha, Zheng Li, Ning Yu, and Yang Zhang. De-fake: Detection and attribution of fake images generated by text-to-image generation models. In Proceedings of the 2023 ACM SIGSAC conference on computer and communications security, pp. 3418-3432, 2023.
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International conference on machine learn- ing. pp. 2256-2266222 2265. pmir, 2015.
StableDiifusion. Stable diffusion repository, 2022.
Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Frequency- aware deepfake detection: Improving generalizability through frequency space domain learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 5052-5060, 2024a.
Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethinking the up-sampling operations in enn-based generative network for generalizable deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
28130-28131 2024b.
Chuangchuang Tan, Renshuai Tao, Huan Liu, Guanghua Gu, Baoyuan Wu, Yao Zhao, and Yunchao Wei. C2p-clip: Injecting category common prompt in clip to enhance generalization in deepfake detection. Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 7184- 7192,
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In International conference on machine learning, pp. 10347-10357. PMLR, 2021.
Unsplash. Unsplash Homepage. httpps:/unsslaastt
2025. Accessed: 2025-08-01.
Sheng- Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 8695-8704, 2020.
Zhendong Wang. Jianmin Bao, Wengang Zhou, Weilun Wang. Hezhen Hu, Hong Chen, and Houqiang Li. Dire for diffusiin-ggneratee image detection. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 22445-22455. 2023.
Wukong. Wukong repository, 2023.
Shilin Yan, Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Weidi Xie. A sanity check for ai-generated image detection. arXiv preprint arXiv:2406. 0ete:24406/9435... 2024a.
13

---

Published as a conference paper at ICLR 2026
Zhiyuan Yan, Jiangming Wang. Peng Jin, Ke- Yue Zhang, Chengchun Liu, Shen Chen, Taiping Yao, Shouhong Ding, Baoyuan Wu, and Yuan. Orthogonal subspace decomposition for generaliz- able ai- ai-generated image detection. arXiv preprint arXhv:2411.1563. 2024b.
Xu Zhang, Svebor Karaman, and Shih-Fu Chang. Detecting and simulating artifacts in gan fake images. In 2019 IEEE international workshop on information fiformationn.oreniiess and security (WIFS), pp. 1-6. IEEE, 2019.
Chende Zheng, Chenhao Lin, Zhengyu Zhao, Hang Wang, Xu Guo, Shuai Liu, and Chao Shen. Breaking semantic artifacts for generalized ai-generated image detection. Advances in Neural Information Processing Systems, 37:59570-59596, 2024.
Nan Zhong, Yiran Xu, Sheng Li, Zhenxing Qian, and Xinpeng Zhang. Patchcraft: Exploring texture patch for efficient ai- ai-generated image detection. arXiv preprint arXiv:2311.12397, 2023a.
Nan Zhong, Yiran Xu, Zhenxing Qian, and Xinpeng Zhang. Rich and poor texture contrast: A simple yet effective approach for ai-generated image detection. arXiv preprint arXiv:2311.12397 2023b.
14

---

Published as a conference paper at ICLR 2026
A
APPENDIX
Our implementation is included in the code folder of the supplementary zip. The HiRes-50K dataset will be released soon, and we plan to open-source the full codebase.
B IMPLEMENTATION DETAILS
Training Platform. All experiments are conducted on server equipped with dual AMD EPYC 7543 CPUs, 512 GB of RAM, and four NVIDIA RTX 3090 GPUs.
Model Parameters. We utilize the VIT-L/14 variant of the pretrained vision backbone from OpenAI CLIP Radford et al. (2021) as our feature extractor. Our model incorporates a lightweight, trainable feature refinement Transtormer composed of 2 layers and 2 attention heads. The local aggregation modules are implemented with a single Transformer layer and attention heads. Additionally, we employ 2-layer token-level classification MLP and a 2-layer output classification MLP with ReLU activation functions. For JPEG quality factor estimation, we adopt a 4-layer MI..
Training Settings. The model is optimized using the AdamW optimizer with base learning rate of le-4 and a weight decay 0.05. We use a dropout rate 0.1 throughout the network to prevent overfitting. The batch size is set 64, and the model is trained for total of 10 epochs. For the loss function, we set a = 3 =
Augmentation Settings. We adopt data augmentations including random JPEG compression (QF~ (60, random Gaussian Blur (o ~ (0.1,, 2.5)). random scaling (scale factor~ U (0.25, 2)) and Random Patch Swap augmentation (Swap ratio~ (0.2, 0.98)) improve robustness. Each augmentation is conducted with 10% probability. Inspired by prior works Rajan et al. (2025); Chen al. (2024), we further synthesize paired fake images on certain benchmarks using the VAE com- ponent of the diffusion model originally used to generate the data. Specifically, we use the VAE from Stable Diffusion v1.4 to perform these augmentations.
C INTRODUCTION FOR THE HIRES- 50K DATASET
Table 10: Comparisons between different testsets. Our HiRes-50K dataset encompasses high- quality, real-world scenarios with a broad range of high resolutions, covering image dimensions from 512 pixels up 10K in edge length. Compared to the AlGCDeneelBenchmark Zhong et al. (023b) and the latest Chameleon Yan et al. (2024a) dataset, ours surpasses them in resolution. (IN represents ImageNet.)
9590AN
Righan
Surish
WAR
ARM 746
sps S VORM Widee IMTEP
O medin
Stagttak
6.32
430
2.06
4.8
335
12.32
1202
1233
1239
TAIN
12,2
12,N
150%
Roal
C.I INTRODUCTION
With the rapid advancement of image generation models, the visual fidelity of Al-generated con- tent has significantly improved. Image resolu- tions have progressed from 512 512 over 1000 1000. Earlier methods were mostly trained and evaluated on low-resolution Al-generated im- ages because image synthesis models were not
Fale
Image Numbers
3000
able produce high-resolution outputs at that
time. To overcome the common limitations of existing Al-generated image detection datasets, such low-resolution datasets and the simplistic nature of images generated from basic prompts, introduce high-quality dataset comprising high- nigh-resolution and diverse images that are of- ten indistinguishable from real photographs to the
1000
Destibiton mage long-edge resolution
Figure 7: Resolution distribution. Image long- edge resolution distribution in our HiRes-50K dataset.
15

---

Published as a conference paper at ICLR 2026
human eye, designed to evaluate detection models under high-resolution settings and support the de- velopment of more robust detection techniques.
C.2 DATASET COMPOSITION
C.2.1 AI-GENERATED IMAGES
The Al-Generated part contains over 25,000 images spanning diverse categories, including portraits, landscapes, architecture, vehicles and animals. Among these, portraits constitute the majority and encompass wide range of subjects such as facial close-ups, upper-body shots, full-body images, group portraits, and human figures embedded in natural or social contexts. Landscape images cover environments such as mountains, beaches, cities, rural areas, and deserts under various weather conditions (e.g.. clear skies, snow, sunrise, sunset). Architectural images mainly depict modern urban scenes, such as skyserapers, villas, and urban neighborhoods. The sample images are shown in Figure g
The long side resolution of images ranges from under 900 pixels to over 10,000 pixels. To analyze resolution-specifie performance, we group images into eight resolution bins: [0, 900], [900, 1200), [1200, 1500], [1500, 2000], f2000, 3000]. [3000, 5000), [5000, co), with corresponding sample counts of 845, 6665, 6399, 5262, 3674, 571, 1196 and 472, respectively. Notably, the majority of Al-Generated images fall within the [900, 2500] range, which reflects typical image resolutions encountered online and exceeds those used in traditional benchmarks (e.g., 224-512 pixels). This broad resolution coverage supports comprehensive evaluation across scales. To ensure visual fi- delity, we estimate JPEG quality factors for all images and filter out those below 75. This selection process removes low-quality content and guarantees high-quality dataset suitable for rigorous de- tection model assessment.
C.2.2 REAL IMAGES
To ensure fair and balanced comparison, we align the real images with the generated ones in both resolution and JPEG compression level. For each image class, we first select high-quality real images with larger dimensions and higher fidelity than the corresponding Al-generated images. These real images are then resized to the total pixel count which matches the Al-generated images by multiplying a pixel scaling factor. This operation maintains the aspect ratio of real images. After resizing, we apply JPEG compression using the same quality levels observed in the synthetic data. This procedure ensures that within each subcategory, the real and Al-generated images have similar distributions in terms of both resolution and compression. We also maintain a one-to-one ratio between real and generated images for every class. As result, our benchmark supports controlled and meaningful evaluations across the two domains. Sample images are shown in Figure
C.3 COMPARISONS WITH EXISTING DATASET
In Table IO we present comprehensive comparative analysis between our HiRes-50K dataset and AIGC test sets. The HiRes-50K dataset exhibits three distinguishing characteristics: (i) Magnitude. Encompassing 50,658 test images, our dataset constitutes the most extensive collection date, sig- nificantly surpassing existing single test sets in scale and thereby enhancing robustness in evaluation. (ii) Variety. The data set incorporates diverse array real-world images, spanning categories such as portraits, landscapes, architecture, vehicles and animals. This breadth of coverage exceeds the narrow categorical scope of comparable datasets. (iii) Resolution. The images exhibit a wide res- olution spectrum, ranging from 512 pixels to over 10K pixels the long side. In summary, the HiRes-50K dataset establishes a more rigorous and pragmatically relevant benchmark, advancing the development of Al-generated image detection methodologies.
C.4 DATA SOURCES
Our dataset is primarily constructed from several widely used online communities that provide either AI Al-generated real images. We are grateful for their free and open contributions, which signifi- cantly support academic research in this field.
A Al-generated Image Communities:
16

---

Published as a conference paper at ICLR 2026
Freepik
Liblib Al
Civitai
Real Image Community:
Unsplash
C.5 LICENSING AND COMPLIANCE
We adhere strictly to the terms of service and licensing agreements associated with each image source:
Freepik: All images were obtained through paid downloads under Freepik's licensing terms, which permit legal use of selected Al-generated content for research purposes.
Civitai: We comply with the Civitai Terms of Service (Section 9.2), ensuring that all se-
lected Al-generated images are publicly available and approved for reuse.
Liblib AI: We follow the Liblib AI User Agreement (Section 6.2.2) and only images that are openly accessible and permitted for public use.
Unsplash: All real-worle photographs from Unsplash are used under their openly licensed terms, which support research and educational purposes.
D THEORETICAL PROOF OF INFO-PRESERVIE
D.1 FOURIER PRELIMINARIES
DTFT/DFT. For a ID sequence æfn]. DTFT and N-point DFT are
X(e =
æ|nle jun
(13)
R=
N-1
X = Σ
z|nle i 2 kn
k= = 0, N.....N-1
(14)
==U
The DFT samples the Perpeoio DTFT:
2
X ((elw), Wk
(15)
Rectangular Window and Dirichlet Kernel.
Let the length-M rectangular window be:
1, 0 O
W [n]
(16)
o, otherwise.
Its DTFT is the Dirichlet kernel with centering phase
sin M 2
W (M(ee -1 Dn(w),DMlce
(17)
sin 1
DTFT under rate change (real D > 0). We define decimation by real factor D > 0 as ban- dlimited resampling: let (es(w be X(ciw) low-pas- filtered to [w] < x/ D. Then
Y(elw) TJ X (I((ou/D)
|wl <
(18)
In the rational case D = N/M with M, E Z+.
M N Xip (ciUMIN).
Y
(19)
(Proof sketch: interpret y/m] as ideal bandlimited interpolation in] followed by sampling on the grid m.:; time-rate change by D maps w/ D and introduces the factor 1/D.)
17

---

Published as a conference paper at ICLR 2026
Fake samples les
Real samples
Fake samples
Real samples
Category-Rich Samples in HiRes-50K Dataset
Figure 8: HiRes-50K Dataset Samples. Our HiRes-50K dataset combines various categories from real world scenarios, including human, architectures, animals, vehicles and landscapes. The first row displays the fake image collected from internet communities, while the second row indicates the real images.
D.2 RESIZING AS LOW-PASS TRUNCATION
the respective DFT grids shows that the DFT of the resized signal is a scaled version of the low-frequency coefficients of the original signal's DFT. To formalize this, we consider the frequency indices centered around the DC component (r = 0). The relationship between the M M-point DFT [r] and the N-point DFT X is:
1D derivation. Evaluating the DTFT relationship from equation 19
M
M X[r). for 2 Sr< M N
Yirl
(20)
and is zero for all out-of-band frequencies. This explicitly states that the M -pintt spectrum is formed by taking the M nowest-frequent components of the N N-point spectrum (properly centered), scaling them, and discarding all others. This corrected formulation aligns with the standard understanding of ideal resampling and is consistent with the 2D case below.
18

---

Published as a conference paper at ICLR 2026
2D extension. For an N1 N2 image downsampled by (D1, D2) M1 M2 (D, M, with ideal separable low-pass prefilters, the 2D DTFT obeys the rate-change rule, including the amplitude scaling:
Y( _lux))=
M1 Xip
(e'Di, e2)))
|
< π.
(21)
N1
Here, Xip the low-pass filtered version of the original signal's DTFT. Sampling this relationship on the Mi x M2 DFT grid and applying equation 15 along both axes gives the centered low-pass truncation:
M2 N
r2]
<
Mr 2
|r2|
M 2
(22)
and Y[r1, r2] = 0 outside this region. Thus, resizing preserves only the in-band (low-frequency) coefficients and inretrievbll discards high-frequency content.
D.3 CROPPING AS WINDOWING & SPECTRAL LEAKAGE
ID crop. Cropping the length-M M segment that starts at index A is the same multiplying z/n] by a shifted rectangular window:
r/n] wM [n- A]
(so u(n] for (A,A+ + M 1)),
i.e.
y|4] = x (x) v(m].
(23)
The DTFT of the shifted window is linear phase times the Dirichlet kernel,
V(el") e A=m War(e e شسس e - - Das (w),
-
(24)
where WM and DM are given in equation 17 By the convolution theorem:
((cl))=
2T [" X(e)") V
vi (ell--)) du (X+V)() (x* [c-J0A Wrrl (w))
(25)
Since War is the Dirichlet kernel, equation 25 convolves X with broad mainlobe plus sidelobes; this spreads (leaks) energy from all frequencies of x across the spectrum of y. The linear phase -jww only shifts phase and does not change magnitudes, so cropping preserves rather than removes high-frequency content. Hence the spectral-leakage effect that preserves high-frequency cues.
2D crop.
For a tile of width Mj and height M2 with top-left offset (A1, A2),
y|m1, m2] A|A1 + m., A + m2] wM, [m1] WM, [m2)]
(26)
Let
W "r Mr W, (elws, clws) e -Ju M jwz My-1 DM, (wh D (w2)
(27)
be the 2D window DTFT. Then
Fly)(e eww) (X(e ( (f ( WMI,Ms (elws edw2).
(28)
ie., windowing induces Dirichlet-kernel convolution (spectral leakage) together with phase term from the spatial offset.
D.4 RECONSTRUCTION FROM CROPPED TILES
Consider partition of into na Xn1 non-overlapping tiles indexed by (a, b), with sizes _ XM
and top-left coordinates A (1) Eico M,")) and A EEee 22 Define the tile (a, 6) in its
local coordinates by
(ta,)/mm,,y 1(A - mi, 1 + m2m
0 S mi < M(1) 0 S m2 < 0 (29)
19

---

Published as a conference paper at ICLR 2026
Its DTFT is
M M
(aa,) ee
Σ
(ma,))mm,,,a)) m -Jer mi twrma))
(30)
my
=0
mg
The DIFT the full image equals the phase-aligned sum of tile DTFTs:
ngg 11-1
(wis!" ((a e
X(e )
Σ
(31)
b=0
Proof. Embed each tile back to global coordinates via
(a) [11. n2]
V(a.b) n1 A00 n2 - -!
which equals 1 [m,, ne] the tile support and elsewhere. Since the tiles are non-overlapping and cover the image.
no
mn-11
[n1, n2]
I(a.b) [M1, 02).
(Linearity) Taking the DTFT yields
no n1 ((e (jus)
He edwr).
6=0
(Shift) By the 2D shift property,
F(z(a,))((" elus) = -Sws -s(w) Fl e
(32)
Using equation 30 we have F(y(aa)) = Y(ab)). hence
1mm-1 11
(e (dwz)
[(wn (a.s)lelur,,du
(33)
0=0
which proves equation 31
D.5 PUTTING IT TOGETHER: CROP VS. RESIZE
Resizing D$2. truncates the spectrum per equation 22 and discards high-frequency content. Crop- ping ($D.3) multiplies the signal by a rectangular window whose DTFT is the Dirichlet kernel equation 17 yielding the convolution equation 25 that redistributes (rather than removes) high- frequency energy across the band. Finally, combining non-overlapping tiles with the phase factors in equation 31 exactly reconstructs the global DTFT, guaranteeing full-spectrum coverage.
Therefore, by operating tiled crops with explicit full-spectrum coverage and phase-consistent aggregation, HiDA-Net is intrinsically suited to retain fine- ane-ggrined high-frequency cues. While this analysis is based on ideal filters, its conclusion holds in practice, standard resizing algorithms (e.g.. bicubic interpolation) approximate this low-pass filtering and thus inevitably attenuate the very high-frequency details that cropping preserves via spectral leakage. This ability to exploit information across the full spectrum leads to stronger detection on high-resolution images.
E
MORE COMPARISONS
To further assess the generalization ability of our method, we conduct additional experiments across four representative datasets. Accuracy (ACC) is reported using fixed decision threshold of 0.5.
Evaluation on Chameleon. We first evaluate models trained on the Stable Diffusson v1.4 (SD v1.4) subset and the complete GenImage dataset. Testing conducted the Chameleon dataset, with
20

---

Published as a conference paper at ICLR 2026
Table 11: Dataset Details in Benchmark GenImage.
Dataset
Image Size
Number
Source
Train
SD vl.4 StableDiffusion 2022
512 x 512
324.0k
ImageNet
Deng et al.
2009
BigGAN (Brock et al. 2019
256 x 256
12.0k
ImageNet
Deng et al.
2009
ADM (Dhariwal & Nichol
2021
256 x 256
12.0k
ImageNet
Deng et al
2009
Glide (Nichol et 2022)
256 x 256
12.0k
ImageNet
Deng
2009
Midjourney (Midjoumnyy
2025'
1024 x 1024
12.0k
ImageNet
Deng et al.
2009
Test
SD v1.4 StaabeDDittusion
2022
512 x 512
12.0k
ImageNet
Deng et al.
2009
SD v1.5 StableDittuste
2022)
512 512
16.0k
ImageNet
Deng al... 2009
VQDM GG el al.
2022
256 x 256
12.0k
ImageNet Deng et al.
2009
Wukong
Wukong 2023
512 X 512
12.0k
ImageNet Deng et al.
2009
Table 12: Cross-model accuracy (Acc) performance on the Chameleon testset. For each training
dataset, the first row indicates the Ace evaluated on the Chameleon testset, and the second row gives
the Ace for "fake image/real image" for detailed analysis. All results of former methods can be
sourced from the paper Yan et al. (024a)).
Training
CNNSppt
Fusing
UnivED
PatchCraft
Ours
60.11
56.86
57.07
55.62
59.71
56.32
58.13
62.60
73.44 (+10.84
v1.4
8.8698.63
L3798857
0,0099996
17.65/93.50
11.8695.67
3,07/96.25
2,43/100.000
20.33/91338
65.47/79.44 .779.41
All Gentmage
57.23
57.09
60.42
57.83
55.70
57.81
65.77
79.10 (+73.3%%)
9,8699.25
0.8999.55
0,02/99.98
85.52/41.56
2.03/99.73
1.996652
1,6//100.00
26 809506
76.77/82.00
results summarized in Table 12 When trained on the full Genlmage dataset, HiDA-Net achieves an accuracy of 79.10 %, outperiorming the previous best by a substantial margin of 13
Evaluation on HiRes-50K. Next, we train all models on the full GenImage dataset and evaluate them on our proposed HiRes-50K benchmark. As shown in Table 13 our method outperforms all competing approaches. Notably, accuracy sometimes increases with resolution as richer cues expose synthetic artifacts, underscoring our method's scalability and robustness at extreme resolutions.
Evaluation on GenImage. For the public Genlmage benchmark, models are trained on the SD v1.4 subset and tested across all official subsets. Detailed dataset statisties are provided in Table [I The evaluation results are shown Table. 14 This experiment verifies the model's consistency under varying generative styles and semantic contents.
Evaluation on DRCT. In addition, we evaluate performance on the DRCT dataset. All models are trained on the SD v1.4 subset of DRCT and tested across all available test sets. The results, presented in Table 15| demonstrate our model performs strongly, especially for high-resolution SDXL images 1024 x 1024 and DR variants (partially inpainted images) showing the model's robustness under partially inpainted image conditions and domain-specific artifacts.
To summarize, our method consistently achieves strong performance across various benchmarks, particularly in high-resolution settings. Incorporating fake-real pairs via VAE reconstruction further boosts accuracy, confirming HiDA-Net's scalability and generalization.
F DETECTION OF LOCAL MANIPULATION ARTIFACTS
We introduce the Token-wise Forgery Localiza- tion (TFL) task provide token-level supervision for localized manipulations and to enhance model interpretability.
Image
Random Patch
Image
As illustrated in Fig. we adopt a Random Patch Swap (RPS) augmentation strategy. For a given pair of real and fake images, we ran- domly swap a portion of the corresponding re- gions to form a composite image that contains both authentic and manipulated content. When such paired samples not available, we instead secelt a random real image and a random fake im- age for patch swapping. This process yields
Assemble
Detail
Reconsfructed Image
Paired Fake Image
Pixsl Level Image
Figure 9: Random Patch Swap (RPS) Aug- mentation. Real and fake images (e.g. VAE- reconstructed pairs) blended by swapping small local regions between them.
21

---

Published as a conference paper at ICLR 2026
Table 13: Cross-model accuracy (Acc) performance on our HiRes-50K Dataset. All methods were trained on all available training subsets of Genlmage and evaluated on HiRes-50K subsets with different resolutions.
Reso Enion Kange
(..000)
[000, 1200)
1200] 1900)
1500, 3.00
[300, 2000)
200R, J000:
1000,
[XT 5C)
Iroge Nummrrs
1690
13330
12795
10534
7748
1142
2328
944
S0666
CNNS Wanr al
20201
$3.46
56.37
53.75
63.14
67.42
66.30
58.50
f11.25
FeeDes Prame p0l0
63.67
55.63
57.31
$3.90
58.16
67.78
$7.23
51.06
59.72
Uaiv Comeere Slee
67.00
38.35
62.20
63.95
66.05
56.20
58,35
60.05
62.00
DIRE Wane oral 2lea
59.31
64.25
62.10
06.56
75.84
03.40
69.31
62.18
65.36
AIDL rrareral Roee0
65.57
57.29
19.90
59.23
51.88
05.31
61.04
42.06
56.46
DRC
HURITT Lere 2003
57.81
61.67
02.25
02.26
62.31
59.72
58.74
16.40
$8.90
DRCntCl (Cntrerra) 2024
65.30
66.19
68.75
08.85
16.78
75.79
09
58.00
87.17
57.45
52.81
59.83
63.17
65.31
55.95
70.65
69.49
60.07
TeturCCop:LaiFD)
64.14
58.90
01.15
62.52
66.48
59.32
59.11
66.30
02.26
Oue
$2.98
81
78.16
73.99
88.26
90.15
$2.88
09.34
50.33
Table 14: Cross-dataset accuracy the Genlmage Dataset. All methods trained on SDv1. and evaluated on all Genlmage.
Method
Midioumey
GLIDE
ResNet-50lHe et
2016
CVPR2016
$4.9
99.9
99.7
53.5
61.9
515.2
56.5
$2.0
72.1
DeTF-S
Touvion
JCML2021
55.6
99.9
99.8
19.8
58.1
98.9
56.9
53.5
71.6
ICCV2021
74.8
CNNN Wamz BTa
CVPR2020
95.9
50.1
39.8
78.6
53.4
46.8
64.2
Spcc Zhane c R1 A09
WIFS2019
$2.0
99.1
99.2
19.7
49.8
91.8
55.6
19.8
68.8
F3Nd
RURT
BCCV2020
50.1
99.9
99.9
49.9
50.0
99.9
49.9
29.9
68.7
Gramne
CVPR22200
Univ Djoare
71.9
94.3
88.8
Patch bill 7loepe
20233
Araiv
79.0
89.5
89.3
77.3
78.4
89.3
83.7
72A4
82.3
NPR Tan mr A02410
CVPR2204
81.0
98.2
97.9
76.9
89.8
96.9
84.1
84.2
88.6
Preq
AAAE322
86.5
97.3
75.8
86.8
FatFormer Li
CYPR2024
92.7
100.0
99.9
75.9
58.0
99.9
98.8
88.9
DRCT DRCT ar M07A
CCML22124
91.5
95.0
94--4
799.4
89.1
94.66
90.0
81.6
89.4
AIDE Tal
ICLR2025
79.4
99.7
99.8
78.5
91.8
98.7
80.1
66.9
86.8
ICML2225
SAFF
99.4
99.3
96.3
98.2
96.3
97.8
95.6
C2P:CT.IP Tan 2f
2025
AAAE2025
58.2
90.9
97.9
96.4
99.0
98.8
96.5
98.7
95.8
Ours/No VAE Auprxcitation
97.8
98.4
98.3
86.2
98.0
98.4
95.6
96.2
966.1 (+0.318)
Ours/SDv1.4
92.7
99.1
98.0
96,9
97.8
(47.39))
continuous-valued "soft" supervision label Mtoken [0, 1] for each ViT patch token, calculated as the average of binary pixel-level labels within the corresponding patch area.
We present prediction results from HiDA-Net model on partially manipulated images in Fig. IO
This image are generated via Al-based inpainting using Stable Diffusion v1.4. Specifically, we partially overwrite regions in the real image by adding noise its latent representations, followed by reconstruction through the diffusion process. The resulting synthetic regions are then blended with the original image using predefined binary mask obtain partially forged samples.
Our model accurately localizes the manipulated regions at the tile level. As shown in the prediction maps, regions with higher mask intensity (brighter areas) correspond higher predicted likelihoods of being fake. This demonstrates the model's 's fine-grained localization capability and its sensitivity subtle, localized modifications.
G MORE ABLATION STUDY
We conduct a comprehensive ablation study to systematically evaluate the impact of varying the number of cropped image tiles that are fed into the FAM module during both the training and inference stages. The evaluation protocol follows the same experimental settings as those used in the comparisons on the Genlmage benchmark, ensuring the results are directly comparable. As illustrated in Table [6] the findings reveal clear and consistent trend: increasing the number of local tiles leads to noticeable improvements detection performance. This improvement can be attributed to the model's enhanced ability to capture more detailed and spatially diverse cues as additional tiles are introduced.
Notably, the full-coverage configuration, in which the FAM module receives the maximum number of noe-ovellapping high-frequency tiles extracted from the image, achieves the highest accuracy among all tested settings. This outcome provides strong evidence that incorporating fine- ine-grained local information is highly beneficial for manipulation detection. In particular, by aggregating and integrating localized features across multiple regions, the model is able to construct richer and more
22

---

Published as a conference paper at ICLR 2026
SD Valeers
Tuito Talarts
LOXT
Valanb
COnTRENNT Natarts
DE VonaED
Method
50x/
SDx3
SD-
SDNEL
LEC
LCM
3DV--
5DN2-
SEXL-
SDh/-
SDx2-
S0XL-
CANSSO Waze 2018 B0W
01.00
07:11
5555
37:15
18:35
01
31:35
3::11
09.91
11:11
30331
3117
2111
01181
08.94
94.96
51.61
02.18
64:00
58:37
57
98.23
$3.89
K2.07
53.67
50.07
53005
Gnmby V 77 1u0. bJ80
96.40
0931
0538
63.63
93:43
71 PM
69 52
91.03
07.00
89-97
75.55
B2208
51.23
9341
5008
73.63
09.33
64:00
09:34
02:081
99:13
62:34
06.30 56
30.18
5000
15.52
Usi C0AAAST HDM))
03.30
96.23
03383
91.01
13.91
95.38
$3.00
9032
58 0
11.85
50.06
51.56
51.03
50.45
83
DIRE Soriea 1003
09.19
29.94
08.10
53.54
11.53
59.97
54.35
59:75
20
99.65
64.20
50.13
51.00
5384
45.97
71.23
DRCTISN
59.66
55.0
15.99
90.79
DRCTISD Cireere
99
98.50
09.00
96. 10
08.00
03.
83 50
95. 45
03.33 75
96
95.85
07.56
03.01
99387
20.33
25.03
OwnsiNe VAl A1peeeei
09160
08:75
75.75
08 76
07.78
07:3 56
55.55
06.33
08.75
35.37
96. 15
00.36
74.78
71:17
94.79 202200
OursSDyl
Table 15: Cross-model accuracy (Acc) performance on the different testing subsets of DRCT. Meth- ods are trained on the SDv1.4 subset of DRCT. Results of former methods be soureed from the paper DRCT Chen et al. 2024).
(c) GT Inpainting Mask Figure 10: Visual comparison between the Al-inpainted image, the predicted inpainting mask, and the ground-truth mask.
(a) Al-Inpainted Image
(b) Predicted Inpainting Mask
discriminative representation, thereby significantly enhancing its robustness and overall detection effectiveness.
Furthermore, when the FAM module is executed without incorporating any local tile inputs and in- stead depends solely on the information provided by the global branch, the overall detection accuracy on the Genlmage benchmark experiences a notable decline, dropping to 84.24 %. This considerable reduction clearly demonstrates that global features alone are insufficient for achieving optimal per- formance, and it further emphasizes the crucial role that localized visual cues play in strengthening the model's detection capability. In other words, fine- fine-grained local details extracted from image tiles are indispensable for complementing global representations and ensuring robust performance.
To gain deeper understanding of how the number of cropped tiles influences model effectiveness, we conduct a systematic investigation into the relationship between tile quantity and detection per- formance. Specifically, we evaluate the impact of different tile sampling strategies HiRes-50K dataset and the GenImage benchmark. In this study, we fix the number of tiles n to one of the following values: {1,2, 4, 8, 16). When
both our
1, the model is restricted to using only single center crop during inference, which provides a limited view of the image. For larger values of i.c., when n 1, multiple tiles are randomly sampled, and this sampling process is consistently applied during both the training and inference stages.
In contrast to these fixed strategies, our proposed FAM module employs more flexible and adaptive approach. During training, instead of adhering to predetermined number of tiles, it dynamically samples a variable number ranging from to 16. This stochastic sampling not only introduces greater data diversity but also improves the model's 's ability to generalize. At inference time, rather than relying on random selection, the module adopts a full-coveruge tile cropping strategy, ensuring that all relevant local regions are exhaustively considered. This combination of dynamic sampling in training and comprehensive coverage during inference represents a key factor in the effectiveness of the FAM module.
Table 17 presents the experimental results obtained on the GenImage benchmark, where all models trained using the complete training and subsequently evaluated under different tile configu- rations during inference. From the reported results, we observe a clear and consistent trend: as the number of cropped tiles increases, the detection performance steadily improves. Specifically, when
23

---

Published as a conference paper at ICLR 2026
Table 16: Ablation study on the number of crop tiles in FAM.
Tile Nums
1
2
4
8
16
FAM
ACC (%)
92.14
93.34
95.63
95.69
95.89
96.10
Table 17: Cross-model accuracy (Acc) performance on our HiRes-50K Dataset with different tile crop strategies.
Resolution Range
(0,900)
9000 1200)
1200, 1500)
1500, 2000)
20000 2500)
2500,
(300,,0000
50000
Avg
Image Nambers
1690
13330
12798
10524
7748
1142
2329
944
50568
1 Crop Tile
75.3
74.9
72.8
75.1
73.7
77.2
62.1
74,19
Crop Tiles
79.9
76.7
76.0
74.7
79.4
66.8
77.91
4 Crop Tiles
83.4
$2.1
78.8
78.9
88.6
78.1
80.2
68.1
79.78
Crop Tiles
78.4
89.1
78.3
Crop Tiles
83.6
84.3
79.5
78.0
89.5
77.2
82.1
67.7
80.24
OOurs PAM
82.98
81,39
78.16
78.99
88.26
30.18
82.88
69.88
80.33
the model is restricted single tile, the accuracy reaches only 7..09%. However, the number of tiles is gradually increased, the model is able to capture richer set of localized features, leading to progressively better performance. At the maximum setting of 16 tiles, the accuracy improves to 80.33% %, corresponding to relative gain of more than six percentage points compared to the single- tile baseline. These findings highlight the importance of incorporating multiple localized views of an image, which provide complementary information to global representations and thereby enhance the robustness and effectiveness of the detection model.
Table 18: Intra-Datase accuracy (Acc) performance on our HiRes-50K Dataset with different test- time tile crop strategies.
Resolution Range
(0,900)
(00, 1200)
1200, 1500)
16/K), 2000)
(0000, 2500)
22000, 3000)
(300)) 5000)
5000),
Avg
Image Numbers
10524
944
50568
T Crop Tile
97.8
97.6
98.2
98.1
97.7
97.8
96.4
94.3
97.24
Crop
97.7
Crop Tiles
98.2
98.1
98.7
99.0
98.7
97.9
97.6
95.7
97.99
Crop Tiles
98.4
98.3
99.0
98.6
98.7
98.3
98.2
96.0
98.19
Crop Tiles
98.4
98.4
99.1
98.7
98.6
98.1
96.3
Ours FAM
98.5
99.2
97.8
99.0
99.1
99.5
97.3
96.0
98.30
Table shows results on the HiRes-50K dataset, where we split the data into 50% for training, 25%
for validation, and 25% for testing. A similar trend is observed: increasing the number of tiles used during inference leads to clear performance improvements.
Overall, performance improves more random crops are utilized, demonstrating the importance of diverse spatial coverage. Our FAM-based strategy consistently achieves the highest accuracy, highlighting the effectiveness of its adaptive sampling mechanism.
H POTENTIAL SOCIETAL IMPACTS
The release of the HiRes-500 dataset introduces both valuable opportunities and important responsi- bilities. As one large-scale, high-resolution benchmark for Al-generated image detection, it enables rigorous evaluation under realistic visual conditions and fosters the development of more robust forensic tools. This can greatly assist in identifying synthetic media in journalism, legal investiga- tions, and content moderation. However, by making such data widely available, there is also the risk that generative model developers may exploit it to enhance the realism of forgeries and evade detection. To mitigate misuse, we encourage responsible dataset use aligned with research ethics and advocate for transparent licensing, access control, and ongoing dialogue with policymakers and interdisciplinary stakeholders.
I DETAILS ON LARGE LANGUAGE MODEL USAGE
In this work, Large Language Model (LLM) was used only as an auxiliary tool polish writing, improve grammar, and refine expressions for clarity. It was not used to generate scientific content, design experiments, analyze results, or write substantive parts of the paper. All conceptual ideas, technical contributions, and experiment analyses were conducted entirely by the authors, with the LLM serving solely as a language aid rather than a content creator.
24


Reviews:
[{"review_id": "sOz0UBoOqc", "reviewer": "Reviewer_Uopj", "summary": "The paper addresses the challenge of detecting high-resolution AI-generated images. The proposed framework HiDA-Net processes images in original resolution enabling increased quality of predictions and achieves SOTA performance. The paper also proposes a new dataset HiRes-50K that consists of >50k images of high resolution.", "questions": "The authors should clarify issues described in the Weaknesses section.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The motivation for the method is absolutely clear and supplemented with math and illustrations.\n2. The proposed method achieves SOTA performance on several datasets.\n3. The paper proposed a novel high-resolution HiRes-50K dataset that may be valuable for the community.\n4. The paper includes extensive ablation on the proposed method.", "weaknesses": "Major weaknesses:\n1. The proposed method is not compared with recent AI-generated image detection methods, like [1 - 3].\n2. The proposed method has an increased inference time for high resolution images compared to the other approaches. But what is the difference in speed between the HiRes-50K and the other methods on standard resolutions, like 224 $\\times$ 224?\n3. I have not found the explicit list of models that are used in creating the HiRes-50K dataset. It is important to include the relevant models in the dataset.\n4. Lines 333-334 describe the resizing applied to the real part of the proposed dataset. What was the distribution of the original sizes of it? The resizing operations on the real part of the dataset may have led to models learning resizing artifacts instead of the synthetic images signs.\n\n[1] Karageorgiou, Dimitrios, et al. \"Any-resolution ai-generated image detection by spectral learning,\" Proceedings of the Computer Vision and Pattern Recognition Conference. 2025.\n[2] Koutlis, Christos, and Symeon Papadopoulos. \"Leveraging representations from intermediate encoder-blocks for synthetic image detection,\" European Conference on Computer Vision, 2024.\n[3] Guillaro, Fabrizio, et al. \"A bias-free training paradigm for more general ai-generated image detection.\" Proceedings of the Computer Vision and Pattern Recognition Conference. 2025.\n\nMinor weaknesses:\n1. The quotes could be isolated from the text to improve readability (e.g. “generative models (Karras et al. (2017))”)\n2. The text mentions that the dataset contains only images with resolutions below 1K to over 10K pixels, however Figure 4 shows that the biggest resolution is below 6K. Does the dataset contain higher resolutions and what is the percentage of it compared to the other dataset?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "E5mpf8QVbk", "reviewer": "Reviewer_L8Yu", "summary": "This paper proposes a High-Resolution Detail-Aggregation Network (HiDA-Net) for detecting AI-generated images in high-resolution inputs. To effectively capture both global context and local details, HiDA-Net processes the input image through two complementary paths — a global path and a local path — where global and local features are extracted for classification. \n\nTo aggregate these features effectively, the authors introduce three key modules: the Feature Aggregation Module (FAM), Token-wise Forgery Localization (TFL), and JPEG Quality Factor Estimation (QFE). Specifically, FAM aggregates the [CLS] tokens from local detail tiles and the global token to form a discriminative feature representation for classification. TFL introduces a Random Patch Swap (RPS) augmentation to create partially manipulated images, providing token-level supervision that enhances spatial sensitivity to localized forgeries. QFE, implemented as a lightweight MLP, predicts the JPEG quality factor to help disentangle compression artifacts from generative ones.\n\nIn addition, the paper presents a new dataset, HiRes-50K, which provides a large number of high-quality images for evaluating detection performance. Experimental results show that the proposed method achieves superior performance on both the Chameleon and HiRes-50K datasets. However, several questions and concerns remain, as listed below:", "questions": "The questions I concern have been posted in the Weakness section. The authors can prepare their rebuttal with reference to the review comments in Weakness section.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. The paper convincingly identifies and quantifies how resizing harms detection by losing high-frequency details.\n2. It introduces a new and high-quality dataset, named HiRes-50K, for evaluation.", "weaknesses": "1. The proposed method includes both a global and a local path, but uses the same transformer blocks to process global and local images. How do the proposed FAM, TFL, and QFE modules adaptively extract and distinguish local and global features for classification? It is unclear why these modules can effectively capture both types of features simultaneously.\n\n2. The computational complexity of transformer blocks is quadratic. When more local patches are used, this inevitably increases the processing time and computational cost. How is this issue addressed or mitigated?\n\n3. The paper claims that local details are crucial for detection performance, implying that the size of the local image patches plays an important role. How does the patch size affect overall performance?\n\n4. Important ablation studies are missing. Since the proposed method includes both a global and a local path, an ablation study should be provided to evaluate the effectiveness of this dual-path design. How do the global and local paths individually contribute to the final performance?\n\n5. For a fair comparison, the paper should clearly provide implementation details, including the training dataset and the model complexity (e.g., number of parameters, FLOPs).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "bR1NvABtio", "reviewer": "Reviewer_LuBd", "summary": "The paper proposes HiDA-Net and HiRes-50K benchmark to prevent performance drops of AIDI on high-resolution images brought by detail loss and limited generalization. Specifically, HiDA-Net aggregates multiple information (local details, global structure, JPEG) with FAM to provide a better understanding of the AIGC image. Also, the introduces HiRes-50K to enable realistic high-resolution evaluation under varied resolution and image quality. Overall, the HiDA-Net achieves SoTA performance in the experimental comparison.", "questions": "See weakness.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The motivation is clear and intuitive. The detailed information loss will introduce misunderstanding for the detection model, especially for the AIGC scene, where most generated models produce well-structured but detail-failed images.\n- The model design is reasonable and theoretically proven.\n- The experiment is comprehensive to demonstrate the effectiveness of the proposed network and benchmarks.", "weaknesses": "- The open-source AIGC image dataset and real-image dataset are innumerable. The paper does not sufficiently explain the core basis for HiRes-50K to surpass existing data resources in terms of irreplaceability or value increment.\n- The experiments primarily rely on outdated models (e.g., SD v1.4, SDXL) for generating AI-synthesized images with limited coverage of other mainstream high-resolution generative models—especially advanced models updated after 2024 (e.g., SD3.5, FLUX, Qwen-Image). \n- The analysis on input degradation focuses on JPEG artifacts; however, the real-world imaging encounters noise, blur, defocus, and moire patterns. Extensive studies on more complicated degradation would improve the integrity of the discussion.\n-  More recent model have employed multiple strategies, e.g., RL and adversarial learning to improve their capability of \"actively evading detection\". The experimental design of the paper does not cover such scenarios.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Fmz5RIyLu2", "reviewer": "Reviewer_MJAJ", "summary": "This paper presents HiDA-Net, a high-resolution AI-generated image detection framework designed to retain fine-grained details by aggregating information from full-resolution local tiles and a global downsampled view. The model integrates Token-wise Forgery Localization (TFL) and JPEG Quality Factor Estimation (QFE). The authors further introduce HiRes-50K dataset. Experimental results demonstrate that HiDA-Net achieves state-of-the-art performance.", "questions": "1. Since tiling is a core aspect of the method, a more comprehensive ablation would strengthen the contribution. Could the authors explore overlapping tile strategies or compare padding-based approaches instead of simply resizing patches smaller than 224 pixels?\n\n2. Is the CLS token for local detail tokens rotation-invariant? For instance, would identical patches with a 90° rotation produce the same output representation ($t_{out}$)?\n\n3. How are the ratios (weights) among different loss functions determined?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Structure of Paper; The paper is technically sound and well-executed, with comprehensive ablation studies that explore the effects of different loss functions, numbers of tiles, and other architectural choices. These analyses effectively demonstrate the contribution of each component to the overall performance. The proposed framework is both conceptually clear and empirically validated.", "weaknesses": "1. Visual Analysis on process: The paper could provide a deeper analysis of the interaction between local detail tokens and global tokens. For example, it would be valuable to examine HiDA-Net’s behavior on AI-inpainted images, where some tiles contain real content while others contain generated regions. Understanding how local detail tokens respond in such mixed cases and how the local aggregator fuses these heterogeneous signals would offer stronger insight into the model’s robustness and interpretability.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)