Few-Shot Learner Generalizes Across AI-Generated Image Detection
Authors: Shiyu Wu
Jing Liu
Jing Li
Yequan Wang
Venue: ICML 2025 poster (2025)
Keywords: Deepfake Detection
Synthetic Image Detection
Few-Shot Learning
Primary area: applications->computer_vision
TL;DR: This paper addresses the challenge of fake image detection by few-shot learning.

Abstract: Current fake image detectors trained on large synthetic image datasets perform satisfactorily on limited studied generative models. However, these detectors suffer a notable performance decline over unseen models. Besides, collecting adequate training data from online generative models is often expensive or infeasible. To overcome these issues, we propose Few-Shot Detector (FSD), a novel AI-generated image detector which learns a specialized metric space for effectively distinguishing unseen fake images using very few samples. Experiments show that FSD achieves state-of-the-art performance by $+11.6\%$ average accuracy on the GenImage dataset with only $10$ additional samples. More importantly, our method is better capable of capturing the intra-category commonality in unseen images without further training. Our code is available at https://github.com/teheperinko541/Few-Shot-AIGI-Detector.

Few-Shot Learner Generalizes Across AI-Generated Image Detection
Shiyu Wu 123
Jing Liu
Jing Li
Yequan Wang 2
Abstract
human society and sparked unprecedented concerns on the
credibility of online information.
Current fake image detectors trained on large synthetic image datasets perform satisfactorily on limited studied generative models. However, these detectors suffer a notable performance de- cline over unseen models. Besides, collecting adequate training data from online generative models is often expensive infeasible. To over- come these issues, we propose Few-Shot Detec- tor (FSD), a novel Al-generated image detector which learns specialized metric space for effec- tively distinguishing unseen fake images using very few samples. Experiments show that FSD achieves state-of-the-art performance by +11.6% average aceuracy on the Genlmage dataset with only 10 additional samples. More importantly, our method is better capable of capturing the intra-category commonality in unseen images without further training. Our code is available at AIGI-Detector.
To curb the spread of AI-generated images used for ma- licious purposes, there is a growing urgency to develop detection methods capable of distinguishing fake images from authentic ones. Early works (Zhang et al., 2019b; Chai et al., 2020) focus on identifying artifacts in synthetic images, which have proved be particularly useful for detecting GAN- GAN-generated images. With the improvement of synthetic image datasets (Zhu et al., 2023; Boychev & Cholakov, 2024), detecting fake images from seen genera- tive models no longer a difficult task. Thus, a novel chal- lenge arises in developing classifiers that generalize across unseen models. To address this problem, some studies (Ojha et al., 2023; Liu al., 2024) adopt a large rision-languaa model to analyze images from semantic perspective, while others (Wang et al., 2023; Luo et al., 2024) leverage the reconstruction ability of diffusion models.
Another difficulty is the acquisition of training data. is often expensive or infeasible to collect enough images from closed-source models such as DALL-E (Ramesh et al., 2021) and Midjourney (mid, 2022). This is due to their service prices and access restrictions. However, most isting fake image detectors (Wang et al., 2023; Ojha et al., 2023) require large amounts of training data to achieve good generalization, and fine- tie-ttnnng without adequate data often results in overfitting. Furthermore, the ongoing release and updating of generative models pose significant challenge for existing detection systems keep up.
Shot-
1. Introduction
The development of generative models has led to signifi- cant strides in synthesizing photorealistic images, making it much more difficult to distinguish Al Al-generated images from real ones. Over the past few years, diffusion-based models (Ho et al., 2020) have exceeded GANs (Goodfellow et al., 2014) and become the mainstream paradigm of image generation, due to their exceptional ability to synthesize high-quality images. With the rapid release of open-source models and web APIs, users can easily create vivid images from brief textual descriptions. However, the increasing abuse of deepfake technology has dramatically influenced
After gaining deep insight into these limitations, we pro- pose an innovative approach based on few-shot learning to overcome them. A robust model is also developed to validate the efficacy of our solution. We first point out that current Al-generated image detection a domain gen- eralization task. Previous studies have been dedicated to discovering universal indicator effective for detecting di- verse fake images. However, they overlook the significant distinctions among data from different domains. We observe that images from unseen domains can actually be obtained in many real-world scenarios. Based on this fact, the com- plicated task can be transformed into a more tractable one, called few-shot classification, through limited samples from unseen domains. Thus, we can extract rich domain-specific
Institute of Automation, Chinese Academy of Sciences, Bei- jing. China Beijjig Academy of Artificial Intelligence, Beijing, China "University of Chinese Academy of Sciences, Beijing, China Harbin Institute of Technology, Shenzhen, China. Correspon- dence to: Yequan Wang <tshwangycquane gmail.ccm.. com>, Jing Liu saiiunniprraa.c.cn..
Proceedings of the 42nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Few-Shot Learner Generalizes Across Al-Generated Image Detection
We introduce an innovative synthetic image detection method, named Few-Shot Detector (FSD). Our ap- proach is able to utilize few samples from unseen domains to achieve better detection performance.
Previous Works
Unseen Samples
Our Method
Training-free
Performance
Our experiments demonstrate the generalization abil- ity of FSD, which significantly outperforms current state-of-the-ar methods and can easily deal with new generative models without further training.
Unusable
Training
Seen
Unseen
2. Related Work
2.1. Image Synthesis
BigGAN ADM
SD1.4
FLUX
Time
Generative Adversarial Networks (GANs) (Goodfellow et al., 2014) have revolutionized the field of generative modeling over the last decade. By simultancously train- ing generator and discriminator in an adversarial manner, GANs can generate samples of high resolution and good quality (Brock et al., 2019; Karras et al., 2020). However, they are prone to mode collapse, which makes it difficult for them fully capture the data distribution. An alternative approach is likelihood-baser modeling, which estimates the parameters of data distributions by maximizing the like- lihood function. Based on this methodology, variational autoencoders (VAEs) (Kingma & Welling, 2014) ensure a smooth latent space that facilitates interpolation and explo- ration of new samples. In contrast, normalizing flow mod- els (Papamakarios et al., 2021) enable exact log-likelihoww computation, allowing them to capture more complex data distributions. However, neither of them match GANs in nigh-quality image generation.
Figure 1. Challenge facing previous works and our solution. Most classifiers exhibit significant performance degradation over unseen data. We address this challenge by introducing a fow-shot strategy which is able make full use of the limited unseen samples.
features from the given samples and use them to generalize across the unseen data, as shown in Figure 1.
Based on the above analysis, we propose Few-Shot Detector (FSD), a novel method which is able to detect fake images with few given samples. In the few-shot classification task, synthetic images from different generative models are clas- sified into separate categories, whereas the real images are classified into single category. The objective is to develop a classifier capable of generalizing to unseen classes that are not in the training set, with only a limited number of examples from them. To solve this problem, FSD utilizes the Prototypical Network (Snell et al., 2017), which learns a metric space to effectively handle unseen data. The given samples are used compute the prototypical representa- tions of different classes. The test image is then classified using the nearest-neighhor method by comparing it against these representations. Thus, FSD can automatically adjust for bias in previously unseen classes without additional training or fine-tuning.
Diffusion Models (Ho et al., 2020; Song et al., 2021) have recently achieved remarkable performance in image syn- thesis. By reversing a gradual noising process, diffusion models can generate images from random noise through suc- cessive denoising steps. Ho & Salimans (2022) introduce classifier-free guidance which enables generating images from text descriptions, eliminating the need for training separate classifier. Another significant advancement is the Latent Diffusion Model (LDM) (Rombach et al., 2022), which applies the diffusion process in latent space with a powerful autoencoder. This approach greatly enhances the visual fidelity of synthetic images while substantially reduc- ing the required computational resources. Leveraging vast amounts of training data, large-scale latent diffusion models (Podell et al., 2024; Esser et al., 2024) have emerged as the leading technique in image generation and the main source of synthetic images at present.
Experiments show that FSD achieves notable improvements over the state-of-the-ard method by +11.6% average accu- racy on the Genlmage dataset. We observe that only 10 samples from the tested classes can significantly improve the detection performance, which highlights the superiority and practicality of FSD. We also show that our approach is better equipped to keep pace with the rapid advancements in image generation, thereby demonstrating the effectiveness of categorizing generated images by their sources.
Our contributions are summarized as follows:
2.2. Al ---gnerrated Image Detection
To the best of our knowledge, we are the first to recon- ceptualize Al-generated image detection as a shw-shot classification task, bringing this task closer to real- world applications.
Model-agnostic detection method. Learning- meth- ods have been applied to detecting fake images from GANs
2

---

Few-Shot Learner Generalizes Across Al-Generated Image Detection
Prototypical Representation
1024-dim Features
Fake Samples
Prototypical Network
Computs
Real Samples
Nearest
Neighbor
Real
Fake
Samples
Figure Detection pipeline of Few-Shot Detector. FSD first maps real and fake images from the support set to the metric space by the Prototypical Network and calculates the representation of cach type. A test image is then mapped into the same space and classified according to the nearest-neighhor principle.
(Zhang et al., 2019b; Qian et al., 2020; Chai et al., 2020). They treat synthetic image detection as a binary classifica- tion task, aiming to find synthetic clues in generated images. Numerous studies (Zhang et al., 2019a; Gragnaniello et al., 2021) have found that classifiers often fail to generalize across unseen generative models, bringing generalization ability the primary research objective. Wang et al. (2020) reveal that detectors for CNN-generated images can be sur- prisingly generalizable due to the common systematic flaws shared among CNNs. Based on this work, Liu et al. (2023) analyze multi-view features to learn a robust representation, while Tan al. (2024b) focus on fighffreueenyy informa- tion capture source-agnostic features.
BLIP (Li et al., 2022) to obtain a text description of the image for better reconstruction, which is capable of detect- ing unseen high-fidelity generated images. AEROBLADE (Ricker et al., 2024) evaluates autoencoder (AE) different latent diffusion models and presents training-free method for detecting fake images based on AE reconstruction errors. Although these approaches have achieved great success on open-source generative models, they still face challenges in detecting synthetic images from various inaccessible models due to the substantial differences among them.
3. Method
In this section, first describe the few-shot classification task for synthetic image detection. Then we elaborate on our novel representation, namely Few-Shot Detector (FSD), as illustrated in Figure
However, these common cues disappear when it comes to diffusion models, leading to the poor performance of earlier methods when applied to them. Therefore, more attention has been paid to semantic level. For instance, Ojha et al. (2023) prove that the informative image features from a pretrained CLIP model (Radford et al., 2021) can be suc- cessfully used for detecting fake images. Other studies (Liu al., 2024; Tan al., 2024a) deeply integrate tex- tual information with images, thereby further enhancing the generalization capability. Morcover, a patch-based detec- tion method (Chen et al., 2024) extracts features from a single patch rather than the entire image, which significantly accelerates the detection speed.
3.1. Few-shot Synthetic Image Detection
Few-shot classification is specialized machine learning task, where the classifier is challenged to generalize to en- tirely new classes not present in the training set, using only limited number of examples from these novel classes. Dif- ferent from end-to-end detection methods that aggregate all synthetic images produced by different generative mod- els into single fake class, we classify these images based their generators. This means that we consider the pro- ductions of each model as an individual class. Conversely, authentic images continue to be grouped into a single class. During detection, the support set comprises labeled images aiding in the classification task, while the query set contains unlabeled images to be classified. The objective of this task is to determine the category of each image in the query set based on the support set.
Diffusion-based detection method. The reconstruction capability of open-source diffusion models has opened new technological pathway. DIRE (Wang et al., 2023) first uses the reconstruction loss to train a classifier, based on the observation that synthetic images can be reconstructed with higher fidelity compared to real ones. SeDID (Ma et al., 2023) analyzes the loss errors between noised and denoised features specific steps of processing, while LARB" (Luo et al., 2024) focuses on the single-step reconstruction sult in latent space. Both of them improve the detection speed by not fully completing the entire reconstruction pro- cess. Fakelnversion (Cazenavette et al., 2024) employs
In detail, we are given a support set S = S US U..-USM which comprises samples from new classes. Each subset S, = [(xa, wh).. (Xa2, Ji2),..., (XiK, B:k)) denotes the collection of images from class i. K is the number of sam-
3

---

Few-Shot Learner Generalizes Across Al-Generated Image Detection
Algorithm Prototypical Loss Computation Algorithm
Class
Class
Input: Training set D = Di U U U... DN. where Dj: denotes the subset of class k; number of training class No; number of support examples per class N₂; number of query examples per class Nq.
Query
Output: training loss J.
V < randomly select Ne classes from 21,2..... .
Class
for l V do
S + randomly select N, samples from Dj.
(a) training
Qx randomly select Ng samples from D Sk
C₁ - N. Ex.Es fx(x))
end for
Class Fake
Class
J f- 0
for l in V do
+
N.N, Ex,eR, log SofSmaax(-dd(f
end for Return /
Test
compute the distances between the test vector and all the representations
(b) testing
, c;), using a distance function d RM x RM - R The probability that the query sample X belongs to class is determined by:
Figure 3. Prototypical calculation. During training, the metric space learned by minimizing the distances between query sam- ples and their corresponding centers. During testing, the test image only classified between real and fake.
ply = xx,,) Sottmax,sss
(2)
The image x, is assigned to the class with the maximum probability, or the nearest prototypical representation
ples in each class. X,j E IRP an image D dimensions and Viy indicates its corresponding label. Each unla- beled image in the query set will be assigned to one of the N classes. This the so-called N-way K-shot task.
As shown in Figure 3(a), during each training step, No classes are randomly selected from the training set. For each selected class i, we randomly choose N, samples from it as the support set S and another N, samples the query set Q, We compute the N prototypical representations ac- cording to Equation (I). The Prototypical Network outputs a probability distribution over the N, classes for each sample in the query set. The optimization target minimize the negative log- probability J(Ø). Pseudo code to compute the loss ((b) is provided in Algorithm
3.2. Few-Shot Detector
Our FSD is based on the Prototypical Network (Snell al., 2017), an effective method for addressing the few-shot ques- tion above. The Prototypical Network aims to learn metric space in which samples from the same class are close in distance, while samples from different classes are relatively distant from each other. Thus, we can represent each class by a single vector, known as the prototypical representation. For each sample in the query set, classification conducted by simply finding the nearest representation to it.
3.3. Zero-shot Classification
We propose zero-shot detection approach to verify the applicability of FSD in real-world settings. In the zero-shot task, there are no additional samples from the test classes. Instead, we are provided with a metadata vector for each class in the training set to categorize the test images. We put considerable emphasis on this task, since acquiring samples from all potential generative models can be impractical. The zero-shot results represent the performance of our model in general scenarios.
In detail, depicted in Figure 2, FSD adopts neural network fo IR - RM to compute the M-dimensional vector in the metric space of an image, where Φ is the leam- able parameters. The prototypical representation e; for class i defined as the average of the embedded vectors derived from its corresponding support set S;:
Σ fo(x)). X,ES,
(1)
S
In this work, we simply define the metadata vector as the prototypical representation derived from an extensive collec- tion of samples. That is, we randomly select a large number of images from each class the training set and then com-
After gaining all the prototypical representations and the vector fo (x,) of test image x, in the query set, we

---

Few-Shot Learner Generalizes Across Al-Generated Image Detection
Table Comparison of our FSD with previous studies. We train several classifiers different subsets and report the accuracy for cach unseen test subset. The best results are highlighted in boldface, while the second -otonal results are marked with underline.
Test Subset
Avg Acc(%)
Method
Midjourney
GLIDE
ADM
SD
VQDM
BigGAN
Spec (Zhang et al., 2019h)
50.0
64.7
52.8
56.1
56.5
63.0
57.2
CNNSpot (Wang et al., 2020)
52.8
73.3
55.0
55.9
54.4
66.2
59.6
F3Net (Qian et al., 2020)
50.1
52.5
66.4
57.0
59.4
50.4
56.0
GramNet (Liu et al., 2020)
51.3
62.6
53.8
56.8
52.2
57.2
55.7
DIRE (Wang et al., 2023)
57.9
68.2
57.3
58.2
59.6
50.8
58.7
LARE2 (Luo et al., 2024)
62.7
80.2
63.5
79.6
76.9
72.0
72.5
FSD (zero-shot)
75.1
93.9
74.1
88.0
69.1
62.1
77.1
FSD (10-shot)
80.9
97.1
79.2
88.8
76.2
82.2
84.1
pute the prototypical representations following Equation (1)- If the nearest representation of a test image is labeled synthetic class, the image will be considered fake.
age detection studies (Zhu al., 2023; Wang al., 2023; Luo et al., 2024), we adopt the accuracy (ACC) and average precision (AP) as our evaluation metrics. The threshold step for computing AP is set to 0.1.
4. Experiment
4.2. Implementation Details
In this section, we first introduce the experimental setups and then provide comparison between FSD and previous studies. We also visualize the feature space to highlight the superiority of our approach.
To be more comparable with previous works, we adopt the ResNet-50 (He et al., 2016) pretrained on ImageNet (Deng et al., 2009) as the backbone our model, which outputs a prototype vector of 1024 dimensions. Following Wang et al. (2023), the imput images are first resized to 256 x 256 and then randomly cropped to 224 x 224 with random horizontal flipping during training. In contrast, only center crop to 224 x 224 is performed after resizing the images during testing. The distance in the metric space is measured with Squared Euclidean Distance.
4.1. Datasets and Evaluation Metrics
Datasets. We evaluate our proposed method on the widely used Genlmage dataset (Zhu et al., 2023), which contains 1, 331,, 167 real images from ImageNet (Deng et al., 2009) and 1, 350, 000 generated images from diffusion models and one GAN. The diffusion generators include Midjourney (mid, 2022), Stable Diffusion V1.4 (Rombach al., 2022), Stable Diffusion V1.5 (Rombach al., 2022), Wukong (wuk, 2022), ADM (Dhariwal & Nichol, 2021), GLIDE (Nichol et al., 2022) and VQDM (Gu et al., 2022). The only GAN utilized is BigGAN (Brock et al., 2019). The real images are first divided into 8 subsets. Each subset is subsequently partitioned into a training part and a test part. Each generator associated with one specific subset and uses the category labels of the real images within the subset to produce synthetic images. Consequently, the Genlmage dataset consists of fake-vs-real subsets for analysis.
To fit the classification task, we employ different few-shot strategies for training and testing. Specifically, we select one synthetic subset the test set and utilize the remaining 6 subsets to train classifier. At every training step, 3 classes are randomly selected from the training set, with 5 samples chosen from each class for the support set and another samples per class for the query set. We employ Adam as the optimizer to minimize the cross-entropy loss with a base learning rate of 10-4, We also adopt a StepLR scheduler with y 0.5 and step_sie sizze = 80000. Each classifier is trained for 200, 000 steps, with batch size of 16. During testing, we conduct binary classification task by comparing the selected test class against the real class. For zero-shot detection, we randomly select 1024 samples from each training subset to compute the metadata vectors. Our method implemented with the Py PyTorch library and all the experiments are conducted single A A100 with 40GB memory.
In this study, the synthetic images in different subsets are categorized into distinct classes, while real images from all subsets are aggregated into a single class. We also observe that 3 diffusion models, SD v1.4, SD v1.5 and Wukong, share identical model structure, making it challenging to differentiate among them. Thus, merge their correspond- ing subsets into a unified subset, named Stable Diffusion (SD). Ultimately, the dataset used in our experiments com- prises 7 classes of images from different sources.
4.3. Comparison to Existing Methods
We compare FSD with several state-of-the-an synthetic im- age detection methods and summarize the results in Table 1.
Evaluation metrics. Following previous AI Al-generated im-
5

---

Few-Shot Learner Generalizes Across Al-Generated Image Detection
Table 2. Results of 10-shot cross-generator image classification on different subsets. Rach classifier is trained on the dataset excluding the subset from the first column. All classifiers are tested on the 6 synthetic classes, reporting accuracy/average precision (%)
Test Subset
Excluding Subset
Midjourney
GLIDE
ADM
SD
VQDM
BigGAN
Midjourney
80.9 / 84.6
99.9/990
98.5 99.3
97.1 /98.7
99.5
88.0/92.9
GLIDE
86.8 / 89.9
97.1/98.
97.9/98.9
97.1 /98.8
99.2/99.7
91.9/9.11
ADM
87.6/91.8
99.9
79.2 83.8
94.8/97.2
91.0/96.1 98.8/99.4
SD
86.1 / 89.7
97.4 98.8 /9.9
88.8/92.
89.5 96.6/98.5
VQDM
82.4 85.9
97.3 /9.9
98.6
95.6/98.0
7
83.5 89.1
BigGAN
88.9 /9.66
99.9
98.3 / 99.3
98.1/99.3
96.4//8.3
82.2/ 86.8
The compared group includes CNNSpot (Wang et al., 2020), Spec (Zhang et al., 2019b). F3Net (Qian et al., 2020), Gram- Net (Liu et al., 2020), DIRE (Wang et al., 2023) and LARE² (Luo et al., 2024). The first four methods are model-agnostic, focusing on identifying synthetic artifacts within fake im- ages. The last two methods leverage the reconstruction error of Stable Diffusion to differentiate between fake and real images. To conduct comprehensive comparison, we train classifiers on different training sets, each of which excludes specific test subset. However, previous studies typically provide several classifiers, and each classifier is trained on one distinct subset and evaluated on the others. To mini- mize the difference between our method and previous works, we report the average performance of classifiers trained on non-test categories and evaluated on each test subset, which can better represent their generalization ability each class.
ability to capture not only the intra-class characteristics but also the common features across all classes. Another ob- servation is that the discrepancy between zero-shot results and few-shot results remains notable, which indicates the necessity of gathering training data from a wider range of generative models.
4.4. Cross-generator Classification
We evaluate the 10-shot performance of FSD on both seen classes and unseen classes. We also train 6 classifiers for the cross-generate image classification task, in which each classifier is trained on 6 out of 7 subsets in the dataset and subsequently tested on the remaining one. We report the accuracy and average precision across each scenario and summarize the results in Table 2.
As shown in Table 2, each row presents the classification results for one classifier across all the synthetic classes. The results show that it is easy for a classifier to detect fake images from those classes encountered during training, which is consistent with the previous studies (Zhu al., 2023; Luo et al., 2024). When it comes to detecting the unseen classes, as shown in the diagonal of Table 2, FSD suffers from a slight decline in performance, demonstrating the generalization capability of our model. Another finding is that FSD performs nearly perfectly on the VQDM class when this class included in the training set. However, the performance significantly declines when this class has been excluded. This fact shows that it is still challenging to generalize across vastly different unseen generative models, indicating that our approach remains inadequate in capturing the discriminative features between classes
As illustrated in Table 1, our FSD attains sfate-of-the-att performance across 5 out of the 6 test classes, surpassing previous
by +11.6% accuracy on average. The suboptimal performance of our model on the VQDM class can be attributed the involvement of image quanti- zation in VQDM, which significantly differs from the other generative models in our experiments. Another reason is that LARE2 is specifically designed to detect synthetic images generated by diffusion models, which enables it to achieve unexpectedly high performance on the VQDM class. Al- though our few-shot method may not be directly comparable to other approaches due accessing only a few samples in the test class, we still regard this discrepancy as signif- icant strength of our model. The definite improvement in performance demonstrates FSD's capability to effectively leverage a limited number of unseen samples.
We also observe the varying performance of FSD across different classes. For instance, images generated by GLIDE, ADM, SD and VQDM are relatively easy to detect by model when these classes are included in the training set, while those from Midjourney and BigGAN are little chal- lenging to identify. Particularly, images from the GLIDE class can be distinguished with exceptional accuracy, even when not included in the training set. These facts indicate the necessity of treating images from different sources as
Based on Table 1, we find that FSD achieves notable per- formance in zero-shot scenarios, in which the prototypical representations are calculated from samples in the training classes. These results show that our approach is also suitable for detecting synthetic images even when samples from the same sources are not provided, thus broadening the appli- cation scope of FSD. We attribute this advantage to FSD's
6

---

Few-Shot Learner Generalizes Across Al-Generated Image Detection
Cibaca
Uirsse
Peel
20
20
20
-20
20
-20
-40
-40
-07
-40
-02
-40
-20
20
60
-10
-40
-20
40
10
-60
-60
-10
-20
20
60
(a) Test on Midjourney
(b) Test on GLIDE
(c) Test on ADM
60
60-
10-
40
GLIDE
CLIDE
10
VCOM
VODM Biad)
VCOM
-20
-0
-42
-00
20
10
-00
-00
-20
65
-00
40
(d) Test on Stable Diffusion
(c) Test on VQDM
(f) Test on BigGAN
Figure 4. Visualization of network features for different classifiers over different classes using t-SNE. Each classifier is trained on those subsets excluding the test one each sub-figure. The features are extracted from the final layer of our model.
distinct categories, which has not been fully explored in previous research. Moreover, it is essential to collect im- ages from representative generative models for training, as generalization on similar generators easier than on those that are vastly different.
tifiable, which demonstrates that our method successfully captures the intra-category features of unseen data.
The results also support the validity of our approach that categorizes samples from different generators as different classes. However, such categorization also introduces the issue of eliminating the significant differences between seen data and unseen data. As illustrated in Figure 4(e), the distribution of the VQDM class in orange exhibits large overlap with that of the real class in gray, due to VQDM's significant differences in image tokenization compared to other models. This also indicates that our method still faces the challenge of detecting images from models that are significantly different from those generative models used in training, which will be the main focus of our future work.
4.5. Visualization
To further analyze the effectiveness of FSD, we utilize SNE (van der Maaten & Hinton, 2008) visualization to illustrate the feature space of classifiers on different training sets, shown in Figure 4. Each classifier is trained those subsets excluding the test one in each sub-figure. We randomly selected 1024 samples from the test part of each class for visualization. The features are extracted from the final layer of our model.
4.6. Ablation Study
From Figure we can see that features of images from different generative models exhibit distinct distributions, each of which is marked by a unique color. Most classes within the training set can be well-separated due to the large margins among their distributions. However, the bound- ary of the Midjourney class represented in red is not as clear as that of the others. This can be attributed to its API service, which may utilize multiple generative models for image generation inferred from our analysis. Although the boundary of the test class in each sub-figure is little ambiguous, the distribution of this class still remains iden-
Impact of the number of shots. An important aspect is to determine the minimum number of samples required by approach to achieve satisfactory performance. We choose different numbers of support samples in each class, ranging from to 200. To present a comprehensive overview of this aspect, we conduct the experiment across all the classifiers described in Section 4.4. We evaluate each classifier on the corresponding test class with varying numbers of support samples. To maintain consistent total number of test sam- ples across different settings, we set fixed ratio of 1 :
7

---

Few-Shot Learner Generalizes Across Al-Generated Image Detection
100
QUIN
90
Accuracy (%)
80
Midjourney
GLIDE
60
ADM
(a) FSD
(b) Binary Classifier
SD
50
VQDM
Figure 6. Visualization of network features for our FSD (a) and a binary classifier (b) on the ADM class. In the feature space of FSD, images from the unseen class purple are tightly clustered together. However, they are significantly more dispersed in the feature space of the binary classifier.
BigGAN
1
3
10
25 50
100 200
Number of shots per class
Figure 5. Influence of the number of shots. Each classifier is trained on those subsets excluding the test one. The 10-shot setting is the most cost-effective setting across all categories.
in purple also cluster together in the visualization picture. In contrast, the traditional binary classifier fails to distin- guish images from Midjourny and Stable Diffusion, as shown in Figure 6(b). The unseen samples in purple are quite dispersed, failing to form compact cluster. Thus, distinguishing them from the real ones can be extremely difficult. This fact indicates that our method possesses a certain ability to extract intra-category commonality from unseen classes, thereby enabling an accurate differentiation among various classes. Moreover, we find that it difficult for a classifier to distinguish samples from Stable Diffusion V1.4 and Stable Diffusion V1.5. One plausible explana- tion could be the shared usage of an identical backbone and VAE, which makes their products highly similar. This implies that we should carefully select the representative generative models to build the training set, which we leave for future work.
between the support set and the query set. The results are shown in Figure 5. Each line represents the performance of one classifier across varying sizes of support set.
From Figure 5, we can see that using more support samples results in better performance. However, it also increases the required computational resources. We find that detecting with 10 shots achieves an optimal balance between per- formance and resource consumption for most of the test classes. For example. our model brings the accuracy the ADM class from 62.6% to 79.2% when increasing the number of shots from 1 to 10, with an improvement of +16.6%. However, it achieves 81.7% accuracy when us- ing 200 shots, gaining only an increase of +2.5% over the 10-shots scenario. As it is easy to collect 10 samples from online generative models and the computational cost is very low, ultimately decide use the 10-shots results of FSD for comparison.
5. Conclusion and Limitations
The key point of detecting fake images in real-world sce- narios is to make full use of the limited number of images from unseen generative models. In this paper, we propose the Few-Shot Detector (FSD), a novel Al-generated image detector based on few-shot learning. Experiments show that FSD achieves state-of-the-arr performance in synthetic im- age detection with only 10 samples from the test generators, demonstrating the strong generalization ability of our model. We visualize the feature space to highlight the advantage of categorizing synthetic images by their sources, an approach that has not been widely adopted in previous studies.
Impact of the multi-class classification. Different from previous studies that treat the fake images as a single class and train a binary classifier to detect them, we categorize the images from different generators as distinct classes. We argue that distinguishing images from different generators can also benefit the detection performance. Thus, train another binary classifier and compare it with our method the ADM class, which is difficult to distinguish according to our experiments. Both classifiers utilize the ResNet- 50 as the backbone and both of them are trained on the dataset excluding the ADM class. We also apply the SNE visualization and randomly select 1024 samples for visualizing. Features of the binary classifier are extracted from the output layer of the ResNet-50, with dimensions of 2048. The visualization results are shown in Figure 6.
However, our method still suffers from a few limitations. Since it not feasible to obtain few-shot samples from all generative models, our collection of synthetic images is confined to part of these models, which may lead to decrease in detection performance. Another weakness is that our method does not perform satisfactorily when detecting images from a vastly different generative model. We aim to address these issues our future work.
Figure 6(a) shows that our FSD successfully distinguishes those images across different classes which have been used in training. Images from the unseen ADM class colored
8

---

Few-Shot Learner Generalizes Across Al-Generated Image Detection
Acknowledgments
In Vedaldi, A., Bischof, H., Brox, T., and Frahm, J. (eds.). Computer Vision ECCV 2020 16th European Confer- ence, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXVI, volume 12371 of Lecture Notes in Computer Science, pp. 103-120. Springer, 2020. 2020.
This work supported by the National Science and Technology Major Project (2022DD0116314), the Na- tional Natural Science Foundation of China (62106249, 62476070, 6243000159, 62102416), Shenzhen Science and Technology Program (CCYI20221200213533000 Department of Science and MSND2223112810222200 12024A151501155 1540), and the Technology of Guangdong
Chen, J., Yao, J., and Niu, L. A single simple patch is all you need for ai-generated image detection. CoRR, abs/2402.01 123, 2024.
Natural Science Foundation of Jiangsu Province under Grant
BK20243051.
Corvi, R., Cozzolino, D., Zingarini, G., Poggi, G., Nagano, K., and Verdoliva, L. On the detection of synthetic images generated by diffusion models. In IEEE International Conference on Acoustics, Speech and Signal Processing ICASSP 2023, Rhodes Island, Greece, June 4-10, 2023, pp. 1-5, IEEE, 2023.
Impact Statement
Al-generated image detection has been subject of extensive research. It is regarded as an important technology to reduce cheating, misinformation and harm on Internet platforms and social media. This work focuses on enhancing the performance of fake image detection rather than increasing synthetic data. All the images used in experiments from open-source datasets. We believe that work can significantly contribute to the development of deepfake- detection applications in many real-world scenarios.
Deng, J., Dong, W., Socher, R., Li, L., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR 2009), 20-25 June 2009, Miami, Florida, USA, pp. 248-255. IEEE Com- puter Society, 2009.
References
Dhariwal, and Nichol, A. Q. Diffusion models beat gans on image synthesis. Ranzato, M., Beygelzimer, A., Dauphin, Y. N., Liang, P., and Vaughan, W. (eds.), Advances in Neural Information Processing Systems 34: Annual Conference Systems 2021, NeurIPS 2021, December 6- 2021, vir- tual, pp. $780-8794, 2021.
Midjoumey. In http::/www.miijonnsssccoohonon 2022.
Wukong. In http::/tthe.mmhhppppre.uuoottttt 2022.
Neural Information Processing
Bai, W. Liu, Y., Zhang, Z., Li, B., and Hu, Aunet: Learning relations between action units for face forgery Computer Vi-
detection. In IEEE/CVF Conference sion and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, pp. 24709-24719 IEEE, 2023.
Esser, P., Kulal, S., Blattmann, A., Entezari, R., Müller, J., Saini, H., Levi, Y., Lorenz, D., Sauer, A., Boesel, F,, Podell, D., Dockhorn, T., English, Z., and Rombach, R. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024. OpenReview.net, 2024.
Boychev, D. and Cholakov, R. Imaginet: A multi-content dataset for generalizable synthetic image detection via contrastive learning. CoRR, abs/2407.20020, 2024.
Goodfellow, I. J., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A. C., and Ben- gio, Y. Generative adversarial nets. In Ghahramani, Z., Welling, M., Cortes, C., Lawrence, N. D., and Weinberger, K. Q. (eds.), Advances in Neural Information Processing Systems 27: Annual Conference Neural Information Processing Systems 2014, December 8-13 2014, Montreal, Quebec, Canada, pp. 2672-2688 2014
Brock, A., Donahue, J., and Simonyan, K. Large scale GAN training for high fidelity natural image synthesis. In 7th International Conference on Learning Representa- tions, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019. OpenReview.net, 2019.
Cazenavette, G.. Sud, A., Leung, T., and Usman, B. Fakein- version: Learning to detect images from unseen text-to- image models by inverting stable diffusion. In JEEE/CVF Conference on Computer Vision and Pattrn Recognition, CVPR 2024, Seattle, WA, USA, June 16 16-22, 2024. pp- 10759-10769. IEEE, 2024.
Gragnaniello, D.,, Cozzolino, D., Marra, F., Poggi, G., and Verdoliva, L. Are GAN generated images easy to detect? A critical analysis of the tf-th-ar-. In 2021 IEEE International Conference on Multimedia and Expo, ICME 2021, Shenchen, China, July 5-9, 2021, pp. 1-6. IEEE, 2021.
Chai, L., Bau, D., Lim, S., and Isola, P. What makes fake im- ages detectable? understanding properties that generalize.

---

Few-Shot Learner Generalizes Across Al-Generated Image Detection
Gu, S., Chen, D., Bao, J., Wen, F., Zhang, B., Chen, D., Yuan, L.,, and Guo, B. Vector quantized diffusion model for text-to-image synthesis. In IEEE/CVF Conference Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pp. 10686- 10696. IEEE, 2022.
International Joint Conference on Artificial Intelligence, IJCAI 2023, 19th-25th August 2023, Macao, SAR, China, pp. 464-472. ijcai.org, 2023.
Liu, F., Luo, H., Li, Y., Torr, P., and Gu, J. Which model generated this image? A model-agnostic approach for origin attribution. In Leonardis, A., Ricci, E., Roth, S., Russakovsky, O., Sattler, T., and Varol, G. (eds.). Com- puter Vision ECCV 2024 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part LXII, volume 15120 of Lecture Notes in Computer Science, pp. 282-301. Springer, 2024.
He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, pp. 770-778. IEEE Computer Society, 2016.
Ho, J. and Salimans, T. Classifier-free diffusion guidance. CoRR, abs/2207.12599 2022.
Liu, Z., Qi, X., and Torr, P. H. S. Global texture en- hancement for fake face detection in the wild. In 2020 IEEF/VVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13- 19, 2020, pp. 8057-8066. Computer Vision Foundation / IEFE, 2020.
Ho, Jain, A., and Abbeel, P. Denoising diffusion proba- bilistic models. In Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., and Lin, H. (eds.), Advances Neural In- formation Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurlPS 2020, December 6- 2020, virtual, 2020.
Lorenz, P., Durall, R. L., and Keuper, J. Detecting im- ages generated by deep diffusion models using their local intrinsic dimensionality. In IEEE/CVF International Con- ference on Computer Vision, ICCV 2023 Workshops, Paris, France, October 2-6, 2023, pp. 448-459. IEEE, 2023.
Karras, T., Laine, S., Aittala, M., Hellsten, J., Lehtinen, J., and Aila, Analyzing and improving the image quality of stylegan. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020, pp. 8107-8116. Computer Vision Foundation IEEE, 2020.
Luo, Y., Du, J., Yan, K., and Ding, Lare2: Latent re- construction error based method for diffusion -generatd image detection. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June / 16-22, 2024, pp. 77006-1701s IEEE, 2024.
Keita, M., Hamidouche, W., Eutamene, H. B., Ha- did, A., and Taleb-Ahmed, A. Bi-lora: A vision- language approach for synthetic image detection. CoRR, abs/2404.01959, 2024.
Ma, R., Duan, J., Kong. F., Shi, X., and Xu, K. Exposing the fake: Effective liffusion-geeeratiee images detection. CoRR, abs/2307.06627/ 2023.
Kingma, D. P. and Welling, M. Auto-encoding variational bayes. In Bengio, Y. and LeCun, Y. (eds.), 2nd Interna- tional Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings. 2014.
Nichol, A. Q., Dhariwal, P., Ramesh, A., Shyam, P., Mishkin, P., McGrew, B., Sutskever, I., and Chen, M. GLIDE: towards photorealistic image generation and edit- ing with text- diffusion models. In Chaudhuri, K., Jegelka, S., Song, I.., Szepesvári, C., Niu, G., and Sabato, S. (eds.), International Conference on Machine Learn- ing, ICML 2022, 17-23 July 2022, Baltimore, Maryland, USA, volume 162 of Proceedings of Machine Learning Research, pp. 16784-16804 PMLR, 2022.
Kukanov, I., Laakkonen, J., Kinnunen, T., and Hautamäki, V. Meta-learning approaches for improving detection of unseen speech deepfakes. CoRR, abs/2410.20578 2024.
Li, J. Li, D., Xiong, C., and Hoi, S. C. H. BLIP: boot- strapping kanguage-image pre-traine training for unified vision- language understanding and generation. In Chaudhuri, K., Jegelka, S., Song, L.,, Szepesvári, C., Niu, G., and Sabato, S. (eds.), International Conference on Machine Learn- ing, ICML 2022. 17-23 July 2022, Baltimore, Maryland, USA, volume 162 of Proceedings of Machine Learning Research, pp. 12888 12900. PMLR, 2022.
Ojha, U., Li, Y., and Lee, Y. Towards universal fake image detectors that generalize across generative models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, pp. 14480-24488) IEEE, 2023.
Papamakarios, G., Nalisnick, E. T., Rezende, D. J., Mo- hamed, S., and Lakshminarayanan, B. Normalizing flows for probabilistic modeling and inference. J. Mach. Learn. Res., 1-:57::157:64 2021.
Liu, C., Zhu, T., Shen, S., and Zhou, W. Towards robust gan- sun-geeeeeted image detection: A multi-view comple- tion representation, In Proceedings of the Thirty-Secone
10

---

Few-Shot Learner Generalizes Across Al-Generated Image Detection
Pellcier, A. L., Li, Y., and Angelov, P. PUDD:
towards ro- bust multi-modal prototype-based deepfake detection. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024- - Workshops, Seattle, WA, USA, June 17-18, 2024, pp. 3809-3817. IEFE, 2024.
SIGSAC Conference on Computer and Communications Security, CCS 2023, Copenhagen, Denmark, November 26-30, 2023, pp. 3418-3432. ACM, 2023.
Shao, R., Wu, T., Nie, L., and Liu, Z. Deepfake- adapter: Dual-level adapter for deepfake detection. CoRR, abs/2306.00855 2023.
Podell, D., English, Z., Lacey, K., Blattmann, A., Dockhorn, T., Müller, J., Penna, J., and Rombach, R. SDXL: im- proving latent diffusion models for high-resolution image synthesis. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024.
Snell, J., Swersky, K., and Zemel, R. S. Prototypical net- works for few-shot learning. In Guyon, I., von Luxburg, U., Bengio, S., Wallach, H. M., Fergus, R., Vishwanathan, S. V. N., and Garnett, R. (eds.), Advances in Neural In- formation Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December
Qian, Y., Yin, G., Sheng, L., Chen, Z., and Shao, J. Thinking in frequency: Face forgery detection by mining frequency- aware clues. In Vedaldi, A., Bischof. H., Brox, T., and Frahm, J. (eds.), Computer Vision ECCV 2020 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XII, volume 12357 of Lecture Notes in Computer Science, pp. 86-103. Springer, 2020.
4-9, 2017, Long Beach, CA, USA, pp. 4077-4087, 2017.
Song, J., Meng. C., and Ermon, S. Denoising diffusion im- plicit models. In 9th International Conference on Learn- ing Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, I. Learning transferable visual models from natural language supervision. In Meila, M. and Zhang, T. (eds.), Proceedings of the 38th International Conference on Machine Learning. ICML 2021, 18-24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learning Research, pp. 8748- 8763. PMLR, 2021.
Tan, C., Tao, R., Liu, H., Gu, G., Wu, B.. Zhao, Y., and Wei, Y. C2P-CLIP: injecting category common prompt in CLIP to enhance generalization in deepfake detection. CoRR, abs/2408. 096407 2024a.
Tan, C., Zhao, Y., Wei, S., Gu, G., Liu, P., and Wei, Y. Frequency-aware deepfake detection: Improving gener- alizability through frequency space domain learning. In Wooldridge, M. J., Dy, J. G., and Natarajan, S. (eds.), Thirty-Eighth AAAI Conference on Artificial Intelligence, AAAI 2024, February 20-27, 2024, Vancouver, Canada, pp. 5052-5060. AAAI Press, 2024b.
Ramesh, A., Pavlov, M., Goh, G., Gray, S., Voss, C., Rad- ford, A., Chen, M., and Sutskever, I. Zero-shot text-to- image generation. In Meila, M. and Zhang, T. (eds.), Proceedings of the 38th International Conference on Ma- chine Learning, ICML 2021, 18-24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learning Research, pp. 2821-8831. PMLR, 2021.
van der Maaten, L. and Hinton, G. Visualizing data using t-sne. Journal of Machine Learning Research, 9(86); 2579-2605, 2008
Wang, S., Wang, O., Zhang, R., Owens, A., and Efros, A. A. Cun-generated images are surprisingly easy to spot... for now. In 2020 IEEE/CVF Conference on Computer Vi- sion and Puttern Recognition, CVPR 2020, Seatile, WA, USA. June 13-19, 2020. pp. 8692-8701. Computer Vision Foundation / IEEE, 2020.
Ricker, J., Lukovnikov, D., and Fischer, A. AEROBLADE: training-free detection of latent diffusion images using autoencoder reconstruction error. In IEEE/CVE Confer- ence on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA. USA, June 16-22, 2024, pp. 9130- 9140. IEEF, 2024.
Wang. Z., Bao, J., Zhou, W., Wang, W., Hu, H., Chen, H., and Li, H. DIRE for diffusion diffussin-generraed image detection. In IEEE/CVF International Conference on Computer Vi- sion, ICCV 2023, Paris, France, October 1-6, 2023, pp. 22388-22398. IEEE, 2023.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. In IEEE/CVF Conference Com- puter Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pp. 10674-10685. IEEE, 2022.
Wolleb, J., Bieder, F., Sandkühler, R., and Cattin, P. C. Dif- fusion models for medical anomaly detection. In Wang, L., Dou, Q., Fletcher, P. T., Speidel, S., and Li, S. (eds.), Medical Image Computing and Computer Assisted Inter- vention- MICCAI 2022- 25th International Conference, Singapore, September 18-22, 2022, Proceedings, Part
Sha, Z., Li, Z., Yu, N., and Zhang, Y. DE-FAKE: detection and attribution of fake images generated by text-to-image generation models. In Meng, W., Jensen, C. D., Cremers, C., and Kirda, E. (eds.), Proceedings of the 2023 ACM

---

Few-Shot Learner Generalizes Across Al-Generated Image Detection
VIII, volume 13438 of Lecture Notes in Computer Sci- ence, pp. 35-45. Springer, 2022.
Zhang, X., Karaman, S., and Chang, S. Detecting and simulating artifacts GAN fake images. In IEEE Inter- national Workshop on Information Forensics and Secu- rity, WIFS 2019, Delft, The Netherlands, December 9-12, 2019, pp. 1-6. IEEE, 2019a.
Zhang. X., Karaman, S., and Chang, Detecting and simulating artifacts in GAN fake images. In IEEE Inter- national Workshop on Information Forensics and Secu- rity. WIFS 2019, Delft, The Netherlands, December 9-12, 2019, pp. 1-6. IEEE, 2019b.
Zhong, N., Xu, Y., Li, S.. Qian, Z., and Zhang. X. Patcheraft: Exploring texture patch for efficient ai-generated image detection. CoRR, abs/2311. 123977 2024.
Zhu, M., Chen, H., Yan, Q.. Huang, X., Lin, G., Li, W., Tu, Z., Hu, H., Hu, J., and Wang. Genimage: A million- scale benchmark for detecting ai-generated image. In Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., and Levine, S. (eds.), Advunces in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 16, 2023, 2023.
12


Reviews:
[{"review_id": "76cql2x3jK", "reviewer": "Reviewer_aJMC", "summary": "This paper introduces an approach to detecting AI-generated images by reframing the task as a few-shot classification problem. The Few-Shot Detector (FSD) uses a prototypical network to learn a specialized metric space, distinguishing between unseen fake images and real ones only using very few samples. By treating images from different generative models as separate classes and real images as a single class, FSD improves generalization to unseen models without extensive retraining.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer aJMC,\nMany thanks for your careful reading and valuable comments. We hope our reply further reduces potential misunderstandings. \n\nQ1. How does FSD perform when faced with generative models that are significantly different from those in the training set?\n\nOur comprehensive evaluation on the GenImage dataset has examined FSD's cross-generator generalization capability across diverse diffusion models with varying architectures, covering both pixel space and latent space image generation. The results provide valuable insights into the detector's robustness against structurally different generative models. While these initial findings demonstrate promising generalization performance, we acknowledge the need for further validation with real-world generative models and plan to expand our testing in future work to strengthen these conclusions.\n\nQ2. Is there a way to improve performance without relying on samples from unseen classes in zero-shot scenarios?\n\nWe acknowledge the performance gap in zero-shot settings and agree that integrating domain adaptation or meta-learning could further improve generalization. In our work, we have observed that generative models with similar structures tend to cluster closer together in the learned metric space. This suggests that as we accumulate sufficient samples from representative model types, detecting images from fine-tuned or LoRA-trained models should become easier and more straightforward. We anticipate this collection of representative samples will help minimize the current performance gap in zero-shot detection. \n\nQ3: How sensitive is the method to the choice of support samples?\n\nOur observations indicate that with fewer than 5 samples, the results tend to fluctuate within a certain range, showing noticeable variability. However, as the number of samples increases to around 100 (which is typically not difficult to collect in practice), the performance becomes significantly more stable and reliable. This suggests that the method achieves robust and confident outcomes when provided with an acceptable number of support samples.\n\nIn conclusion, our approach pioneers a few-shot-learning way for deepfake detection. We believe this direction holds potential as a future trend in the domain. We will revise the manuscript to include more details about the zero-shot classification and training strategy. Thank you for your consideration.", "claims_and_evidence": "Yes, the claims made in the submission are supported by evidence. The authors demonstrate through experiments on the GenImage dataset -- that FSD outperforms existing methods, achieving an average accuracy improvement of 7.4%. They provide analyses, including zero-shot and few-shot scenarios, cross-generator classification, and ablation studies on the number of support samples. Visualizations using t-SNE further support their claims.", "methods_and_evaluation_criteria": "Yes, Reframing AI-generated image detection as a few-shot classification task is Using prototypical networks to learn a metric space is suitable for effectively distinguishing unseen fake images with limited samples. The use of the GenImage dataset as a benchmark and metrics like accuracy and average precision are standard and appropriate.", "theoretical_claims": "The submission does not present theoretical claims that require formal proofs. The methodology builds upon established techniques in few-shot learning, specifically prototypical networks. The contributions are primarily empirical, focusing on the application of these methods to AI-generated image detection.", "experimental_designs_or_analyses": "Yes. The experiments are valid, both few-shot and zero-shot scenarios. The authors conduct cross-generator classification and ablation studies on the impact of the number of support samples.", "relation_to_broader_scientific_literature": "The authors reconceptualized AI-generated image detection as a few-shot classification problem, building upon existing work in few-shot learning and AI-generated image detection. By employing prototypical networks, they extend methodologies used in few-shot learning to the domain of synthetic image detection. This approach addresses limitations in prior work that treated fake images as a single class and struggled to generalize to unseen generative models.", "essential_references_not_discussed": "Based on my knowledge, the paper discusses the essential related works necessary to understand the context and contributions. It cites prior studies on AI-generated image detection, diffusion models, GANs, and few-shot learning.", "other_strengths_and_weaknesses": "Strength:\n- reframing the detection task as a few-shot classification problem, which is a good contribution to the field.\n- The use of prototypical networks is interesting in learning a specialized metric space that generalizes to unseen classes with limited samples.\n- The method achieves state-of-the-art performance, with substantial improvements over existing approaches.\n- Addressing the challenge of limited data availability from unseen generators makes the approach relevant for real-world applications.\n\nWeakness:\n- There is a notable performance gap between few-shot and zero-shot scenarios, indicating limitations when no samples from the unseen class are available.\n- The approach assumes that images from different generators form distinct clusters in feature space, which may not hold true if generators produce very similar outputs.\n- Some sections could benefit from clearer explanations, particularly the zero-shot classification approach and the differences between training and testing strategies.", "other_comments_or_suggestions": "N/A", "questions_for_authors": "- How does FSD perform when faced with generative models that are significantly different from those in the training set, such as models using different architectures, styles, or data domains?\n\n- In zero-shot scenarios, is there a way to improve performance without relying on samples from unseen classes? For instance, could domain adaptation or meta-learning techniques be integrated to enhance generalization?\n\n- How sensitive is the method to the choice of support samples? Are there strategies for selecting the most representative or informative samples to enhance performance with minimal data?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethical_review_concerns": "N/A"}}, {"review_id": "z3Z4Mk8OAV", "reviewer": "Reviewer_N8UV", "summary": "The paper presents the Few-Shot Detector (FSD), an innovative approach to detect AI-generated images, particularly from unseen generative models. Traditional fake image detectors often struggle with generalization to new models due to the scarcity and high cost of collecting training data. FSD circumvents this challenge by reformulating the detection task as a few-shot classification problem, enabling it to effectively classify images based on limited samples from unseen domains.\n\n## update after rebuttal\nWhile I appreciate the authors’ rebuttal, key concerns remain unaddressed.  Therefore, I remain inclined to reject the paper.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer N8UV,\nThank you for your detailed feedback and constructive comments. We have carefully considered each point you raised and would like to address them as follows:\n\nQ1: The lack of strategy for obtaining test images from the same domain in real-world applications. \n\nWhile current diffusion models are resource-intensive to train, widely adopted models are often accessible via APIs or open-source releases, serving as representative models. Our approach requires only a small batch of images from such a model to effectively detect generated content—not only from the same model but also across similar domains. Additionally, we have proposed a zero-shot detecting method in Section 3.3 to assess samples outside the training domain, ensuring robust generalization in real-world scenarios.\n\nQ2: Lack of a new benchmark for multiple domain generalization. \n\nCurrent widely used large-scale synthetic image datasets like GenImage and ForenSynths [1] have provided valuable resources for fake image detection, containing samples from diverse generative models with clear source annotations. We identify a critical gap in current research that most existing methods focus narrowly on binary classification (real vs. fake), overlooking the substantial domain-specific characteristics across different generative models. Our work serves as the first framework for multi-domain detection, and we have transformed GenImage dataset to a suitable benchmark for this task, laying groundwork for future benchmark creation once dataset diversity matures. \n\nQ3: A fake image may share similar content with real images. \n\nOur approach is based on the observation that synthetic images generated by different AI models exhibit distinct artifacts, as demonstrated in prior research [2]. While existing solutions often rely on training separate binary classifiers for distinct generative models—a process that is computationally expensive and impractical for large-scale deployment—our method takes a more efficient and generalizable approach.\nBy focusing on classifying images based on their source generators rather than relying solely on content-based features, our network is explicitly trained to identify these model-specific artifacts. This design of our model ensures that it prioritizes forensic traces (e.g., noise patterns, texture inconsistencies, or spectral discrepancies) over semantic content, which is a key limitation in CLIP-based and other content-driven detection systems. \n\nQ4: This approach does not align with the standard practices of single domain generalization. \n\nThank you for raising this important point. You're absolutely right to point out the divergence from conventional single domain generalization approaches. As detailed in our paper Section 4.2, this difference stems from our unique training paradigm which fundamentally requires diverse class samples during the training phase. We acknowledge that this represents a departure from standard practices, but it's a deliberate design choice that enables our model to learn more transferable features across domains. \nWe anticipate that expanding the class diversity during training would further enhance the model's generalization capability, as it would allow the model to learn even more robust feature representations. However, this strategy may not generalize well to binary-classification tasks, where artifacts across categories can exhibit significant differences and shared characteristics among synthetic images may be absent. This is an important direction we plan to explore in future work. We appreciate this thoughtful observation and will carefully address this methodological distinction in our final version to ensure proper contextualization within the field of domain generalization research.\n\nOur approach pioneers a novel few-shot learning framework for deepfake detection and systematically explores the potential of multi-class detection in this field, demonstrating the feasibility of few-shot forensic analysis across generative models. While there exist limitations, it provides foundational insights for future research to address evolving synthetic threats. We sincerely appreciate your expertise in guiding methodological refinements, and we hope these contributions could be considered in the final assessment. \nThank you for your time and understanding. \n\n[1] Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A\nEfros. 2020. CNN-generated images are surprisingly easy to spot... for now. In\nProceedings of the IEEE/CVF conference on computer vision and pattern recognition.\n8695–8704\n\n[2] Liu, Fengyuan , et al. \"Which Model Generated This Image? A Model-Agnostic Approach for Origin Attribution.\" European Conference on Computer Vision Springer, Cham, 2025.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "Most existing methods address the domain generalization problem in forgery detection as a single domain generalization issue, primarily because generative models are not available for test images. This paper introduces few-shot learning into forgery detection, framing it as a multiple source generalization problem. While the proposed setting is theoretically reasonable, the paper does not adequately address key challenges associated with this new framework:\n\n1.\tThe methodology lacks a clear strategy for obtaining test images from the same domain (i.e., generative models) in real-world applications.\n\n2.\tThe paper does not establish a new benchmark for multiple domain generalization, which should include a comprehensive training paradigm, an evaluation setting, and a fair comparison with state-of-the-art methods.\nOverall, while the paper presents an new perspective, it requires significant improvements to effectively address these critical issues.", "theoretical_claims": "The nearest-neighbor method is employed to calculate the similarity between test images and prototypical representations. However, unlike the classic few-shot classification tasks that focus on image content, forgery detection emphasizes image authenticity. Consequently, a fake image may share similar content with real images, potentially leading to its misclassification as authentic.", "experimental_designs_or_analyses": "The comparison with state-of-the-art (SOTA) methods appears to be unfair. As previously mentioned, SOTA methods typically focus on single domain generalization, where models are trained on one type of generative model and tested on others. However, in line 290, the paper reports the average performance of six classifiers, all of which are trained on both GAN and DM models. This approach does not align with the standard practices of single domain generalization, thus skewing the results.", "relation_to_broader_scientific_literature": "This paper attempts to formulate domain generalization in forgery detection using multiple sources. However, it falls short in establishing a coherent framework and lacks a robust evaluation strategy.", "essential_references_not_discussed": "No", "other_strengths_and_weaknesses": "Strengths: \n\nThe attempt to formulate few-shot learning in forgery detection is a promising approach.\n\nWeaknesses: \n\n1.\tThe methodology lacks a clear strategy for obtaining test images from the same domain (i.e., generative models) in real-world applications.\n\n2.\tThe paper does not establish a new benchmark for multiple domain generalization, which should include a comprehensive training paradigm, an evaluation setting, and a fair comparison with state-of-the-art methods.\nOverall, while the paper presents an new perspective, it requires significant improvements to effectively address these critical issues.", "other_comments_or_suggestions": "No", "questions_for_authors": "No", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "dZ2CPoLPV3", "reviewer": "Reviewer_fx2j", "summary": "This paper adopts the concept of traditional few-shot learning (prior to 2022) and utilizes a prototype network to construct an AIGC image detector, with experimental validation demonstrating improved generalization performance.", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer fx2j,\nThank you for your feedback and constructive comments. We appreciate the time and effort you invested in reviewing our work. Here are our responses to your concerns:\n\nQ1. Academic contribution is quite limited. \n\nTo the best of our knowledge, our work is the first to systematically adapt few-shot learning for AIGC detection. While prior research has primarily focused on improving model generalization, our work uniquely leverages few-shot learning to mitigate performance degradation when detecting synthetic images from unseen domains or new generative models. The ability to achieve superior generalization with minimal samples from emerging generative models represents a key innovation of our approach. \nSpecifically, our work makes the following key contributions:\n1. Novel Adaptation of Few-Shot Learning: We propose a pioneering framework that leverages few-shot learning to significantly reduce performance degradation when detecting synthetic images from unseen domains or new generative models. This is particularly impactful given the rapid evolution of generative AI technologies.\n2. Practical Efficiency: Unlike existing methods that require extensive retraining on new collected data, our approach achieves robust generalization with only minimal samples from new domains, offering a more scalable and resource-efficient solution.\n3. Demonstration and Insights: Through comprehensive experiments, we demonstrate that our few-shot adaptation outperforms traditional fine-tuning approaches on widely used benchmarks.\n\nFurthermore, AIGC detection is a question-driven task, and our work provides a novel solution to address it. Our work introduces a new perspective in this field which can inspire future research directions and pave the way for more adaptive detection frameworks in the challenge of rapidly evolving generative technologies. \n\nQ2. ProtoNet is outdated in the few-shot learning domain.\n\nOur primary objective is to validate the fundamental effectiveness of few-shot learning. For this purpose, we intentionally adopt this vanilla yet classic method to ensure a comprehensive and interpretable evaluation. ProtoNet remains a principled and widely recognized baseline in few-shot learning, which allows us to isolate and rigorously assess the performance of few-shot learning without the confounding factors introduced by more complex tricks. Therefore, ProtoNet serves as an ideal choice due to its conceptual simplicity and proven reliability. This approach can help us better analyze the intrinsic advantages of few-shot learning, offering insights that may be obscured by more sophisticated but less concise methods. \n\nQ3. This paper does not provide a comparison with the given approach [1].\n\nWe appreciate your insightful comment regarding the comparison with the approach presented in [1]. Our paper focuses on evaluating few-shot learning methods for AI-generated image detection, and we selected several widely recognized baselines for comparison, which have also been used by this work [2]. We will include comparisons with CLIP-based methods for a more comprehensive evaluation. \n\nQ4. Lack testing on large-scale/high-quality datasets. \n\nAs emphasized in our paper, the primary goal of this work is to propose a novel few-shot learning framework for AI-generated image detection. We adopt the GenImage benchmark due to its widespread use in prior research, which facilitates direct comparisons with existing methods. While numerous datasets have been proposed for deepfake detection, few have gained broad recognition as foundational benchmarks. This study [2] presented at ICLR 2025 is too recent to be thoroughly validated in the literature. Additionally, our current evaluation is constrained by extremely limited computational resources. We appreciate this insightful suggestion and plan to include more experimental results in the supplementary materials.\n\nIn conclusion, our endeavor is to introduce a novel few-shot learning application for AIGC detection, addressing the critical gap in generalization for rapidly evolving generative models. We sincerely appreciate your constructive feedback, which is helpful for us to identify key areas for further refinement. While we acknowledge the current limitations, we believe our study offers a new perspective in AIGC detection, and its methodological innovation—coupled with empirical validation—merits reconsideration for publication. We would sincerely appreciate it if you would reconsider the potential and novelty of our contribution. \nThank you again for your time and insightful critique. \n\n[1] Sohail Ahmed Khan and Duc-Tien Dang-Nguyen. 2024. CLIPping the Deception: Adapting Vision-Language Models for Universal Deepfake Detection. In Proceedings of the 2024 International Conference on Multimedia Retrieval. Association for Computing Machinery, New York, NY, USA, 1006–1015.\n\n[2] Yan et al. A Sanity Check for AI-generated Image Detection. CoRR, abs/2406.19435, 2024.", "claims_and_evidence": "Yes.", "methods_and_evaluation_criteria": "Strength:\n\n- This paper employs a prototype network to construct an AIGC image detector, reducing reliance on training data from newly generated algorithms.\n\nWeakness：\n\n- This paper merely applies ProtoNet without any task-specific improvements for AIGC detection. Therefore, I believe its academic contribution is quite limited.\n\n- ProtoNet is also a decade-old algorithm, making it quite outdated in the few-shot learning domain. Recently, [https://dl.acm.org/doi/10.1145/3652583.3658035] utilized CLIP for few-shot AIGC detection. However, this paper does not provide a comparison with such approaches.", "theoretical_claims": "The paper does not present any theoretical contributions.", "experimental_designs_or_analyses": "The experiments in this paper lack testing on large-scale/high-quality datasets[i.e., WildFake[1], Chameleon[2]], and the compared methods are overly outdated.\n\n\n[1] A Sanity Check for AI-generated Image Detection @ ICLR'25 https://arxiv.org/abs/2406.19435\n[2] WildFake: A Large-Scale and Hierarchical Dataset for AI-Generated Images Detection @ AAAI'25", "relation_to_broader_scientific_literature": "The authors applied an algorithm from the few-shot learning domain and introduced it into the AIGC detection task.", "essential_references_not_discussed": "N/a", "other_strengths_and_weaknesses": "N/A", "other_comments_or_suggestions": "N/A", "questions_for_authors": "N/A", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper received very mixed reviews - accept, weak reject, reject.

The most negative reviewer, fx2j, did not engage in discussions or respond to the rebuttal. His review was very terse, providing limited justification for his negative rating. His concerns were that the selected few-shot algorithm was 10+ years old, and that the authors did not experiment on current datasets. The authors responded that they intentionally used an established few-shot algorithm to demonstrate the approach, and still achieved SOTA results. One of the suggested datasets is from ICLR 2025, presumably a submission under review, and therefore inappropriate to suggest. The other is from AAAI ‘25, published after the ICLR submission deadline. This review was largely disregarded by the AC.

Reviewer N8UV had some reasonable concerns, but others were not as significant to the AC. He was concerned about the requirement for a small number of sample images from representative domains, but this is not a difficult requirement and should be reasonably practical. Most methods assume something similar, explicitly or implicitly. He also asked for a benchmark for the multi-domain setting, but this seems extraneous as the paper’s goal is AIGC detection, not domain transfer. He believes the quantified comparisons did not test under the same settings, which the authors rebutted effectively. R2 responded to the rebuttal, reiterating a few points, which the authors then responded to.

R1’s review is very positive, and reasonably thorough. He appreciates the novel use of few-shot learning for this task, and the SOTA results. Overall the paper presents an interesting idea and should be a contribution to the community.
Decision: Accept (poster)