Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Authors: Anirudh Sundara Rajan
Yong Jae Lee
Venue: ICML 2025 poster (2025)
Keywords: Image Forensics
Spurious Correlation Mitigation
Primary area: social_aspects->security

Abstract: Detecting AI-generated images is a challenging yet essential task. A primary difficulty arises from the detector’s tendency to rely on spurious patterns, such as compression artifacts, which can influence its decisions. These issues often stem from specific patterns that the detector associates with the real data distribution, making it difficult to isolate the actual generative traces. We argue that an image should be classified as fake if and only if it contains artifacts introduced by the generative model. Based on this premise, we propose Stay-Positive, an algorithm designed to constrain the detector’s focus to generative artifacts while disregarding those associated with real data. Experimental results demonstrate that detectors trained with Stay-Positive exhibit reduced susceptibility to spurious correlations, leading to improved generalization and robustness to post-processing. Additionally, unlike detectors that associate artifacts with real images, those that focus purely on fake artifacts are better at detecting inpainted real images.

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Anirudh Sundara Rajan'
Yong Jae Lee'
Abstract
vancements have expanded the potential applications of generative models, they also raise concerns about misuse, including misinformation and fraud. Image forensics aims to address these risks by developing methods to reliably detect Al-generated images.
Detecting Al-generated images is a challenging yet essential task. A primary difficulty arises from the detector's tendency to rely on spurious pat- terns, such compression artifacts, which can influence its decisions. These issues often stem from specific patterns that the detector associates with the real data distribution, making it diffi- cult to isolate the actual generative traces. We argue that an image should be classified as fake if and only it contains artifacts introduced by the generative model. Based on this premise, we propose Stay-Positive, algorithm designed constrain the detector's focus to generative arti- facts while disregarding those associated with real data. Experimental results demonstrate that de- tectors trained with susceptibility to spurious correlations, leading to improved generalization and robustness post- processing. Additionally, unlike detectors that as- sociate artifacts with real images, those that focus purely on fake artifacts are better at detecting in- painted real images. For implementation details, please visit: https://anisundar Positive.
Significant progress has been made in fake image detec- tion, with detectors trained to generalize across CNN-based generators (Wang et al., 2020) and extended to unseen archi- tectures (Ojha et al., 2023). However, reliably detecting fake images from known generator family remains challenge. A key difficulty arises when images undergo post-proe post-processing (e.g.. compression), as demonstrated by Rajan et al. (2025), where detectors trained on images generated by latent dif- fusion models (Vahdat al., 2021; Rombach et al., 2022) exhibited reduced effectiveness in detecting post-processed images. Specifically, detectors trained by Corvi al. (2023) and Rajan et al. (2025) were found to spuriously associate WEBP compression artifacts with real images, which nega- tively impacted their performance. In this work, we focus on improving the detection of fake images generated by a known model family by mitigating the impact of spurious correlations. The most effective approach for developing a fake image detector is to train neural network-basee binary classifier. However, its performance is highly dependent on the training data, and any discriminative feature associated with the data, including subtle post-processing artifacts, can influence the detector's decisions. A common source of such issues is the use of real images for training, which are often collected from online platforms and may have under- gone unknown operations such as compression and resizing prior upload. As result, detectors can learn spurious correlations. Such issues with compression artifacts were also observed in the widely adopted GenImage benchmark (Zhu et al., 2024), as reported by Grommelt et al. (2024).
exhibit reduced
1. Introduction
Recent advancements in deep generative modeling, partic- ularly diffusion models (Sohl-Dickstein al., 2015; Song & Ermon, 2019) and flow-based models (Liu et al., 2023; Lipman et al., 2022), have significantly improved image generation capabilities. The combination of large-scale scale datasets (Schuhmann et al., 2022) and architectural inno- vations (Dhariwal & Nichol, 2021; Esser et al., 2024) has enabled modern systems to generate high-quality images (Pernias et al., 2023; Labs; Podell et al., 2024), often con- ditioned on auxiliary inputs such text. While these ad-
In addition robustness against post-processing. it is es- sential for detectors to accurately identify images generated by newer models within the same generator family. We observe that reliance spurious correlations hinders gener- alization to such models. During training, detectors often focus on differences in image quality between real and fake images, leading them to associate certain artifacts with real images. However, such hypotheses are often incorrect, as the same artifacts can appear in fake images generated by improved models within the same family. This reliance
Universitty of Wisconsin- Madison.. Correspondence to: Anirudh Sundara Rajan
Proceedings of the 4nnd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
such artifacts limits the detector's ability to generalize to newer generators. For instance, detector trained on images generated by Latent Diffusion Models (LDM) (Rombach et al., 2022) (Corvi et al., 2023) struggles to generalize to images generated by FLUX (Labs) for this very reason.
2.2. Learning-Bant Fake Image Detection
Given a known generative model family of interest, the well-established method of training a fake image detector involves the following steps. First, set of real images, usually sourced online, is selected, while fake images are typically generated using the targeted generative model. A neural network detector fo is then trained to solve the binary classification task.
Our main idea is that images generated by a specific genera- tor family should contain distinct artifacts. An ideal detector should focus exclusively on these fake artifacts, with their absence indicating that the image does not originate from generator of that family. Relying artifacts associated with real images is, at best, unnecessary and, at worst, mis- leading. We show detectors perform better when real image features do not affect decisions.
In our work, we assume the following neural network struc- ture for fo- The network is composed of three components: (i) a feature extraction network, 9 # xx' - R which encodes the input image x into a d-dimensional fea- ture vector, where á represents the parameters of the feature extraction network; (ii) a ReLU activation function, applied element-wise to the extracted features, denoted by 7; and (iii) a linear classifier, parameterized by w E and 6 e R. followed by a sigmoid activation function. The parameters of the network are 0 [ w, 6).
To identify features linked real images, we make the fol- lowing assumptions: the output of the entire network passes through ReLU activation before the final layer, and the final output is passed through sigmoid activation for bi- nary classification, where class I represents fake images and class 0 represents real images. Under these conditions, we show that features connected to negative weights in the final layer correspond to patterns found in real images. To mitigate the influence of these features, we propose simple yet highly effective algorithm that retrains the last layer to minimize the loss while ensuring that the weights remain strictly non-negative. This adjustment forces the detector to make its decision using only fake image patterns, ignor- ing spurious real image artifacts. As a result, the detector shows improved generalization. This approach also enables our detectors to effectively detect partially inpainted real images, unlike conventional detectors, which may be influ- enced by real-image features. We validate our method by improving the performance of detectors from Corvi et al. (2023) and Rajan et al. (2025). Ultimately, we hope our findings contribute to the community's 's broader efforts to combat misinformation.
Formally, the output of fe is given by
fø(x) = o T (x)( + b),
where of-) denotes the sigmoid function. This network is trained using the binary cross entropy loss.
3. Issues with Associating the Presence of Specific Features with Real Images
In this section, we first examine how unknown post- processing artifacts in real training images negatively impact detector performance. We then address the broader issues associated with linking specific artifacts to real images.
3.1. Case Study 1: Post-Processing Artifacts
Detectors can inadvertently let subtle differences between real and fake training distributions, such as spurious features like compression or resizing artifacts, influence their deci- sion. Real images, often sourced from online platforms, may have undergone unknown post-processing making it diffi- cult to determine which features the detector may associate with real images. We explore this issue below.
2. Background
In this section, we first define the problem, describe the gen- eral details of training a fake image detector, and introduce the notation used throughout the paper.
2.1. Problem Definition
In their study on fake image detection for latent diffusion models, Corvi et al. (2023) and Rajan et al. (2025) trained a ResNet-50 (He et al., 2016) using real images from the LSUN (Yu et al., 6) and COCO (Lin et al., 2015) datasets. The LSUN images were compressed using the WEBP algo- rithm but saved in the lossless PNG format by the dataset creators. The fake images used to train the detectors did not contain these WEBP artifacts, leading the detectors to associate WEBP compression with the real distribution. We demonstrate this issue in the following experiment.
The task of fake image detection is a binary classification problem. Given a dataset DD = (x); of N labeled samples, where each x, E HR= xW xC represents an image of height H, width W, and C' channels, and y; E 10 is the corresponding label, the goal is learn a mapping f "xXXCC + (0, 1). The label y; 0 denotes real image, while y/- = 1 indicates fake image generated by neural network.
y.)
Experiment Details: We aim to test whether the detector
2

---

Stay-Positive A Case for Ignoring Real Image Features in Fake Image Detection
AP Models
Fake Score Distributions of Corvi
LDM (4-chanmel Autoencader) Flux 110 channel Autoencoder)
100
0.9
Average Precision
0.7
Frequency
60-
0.5
Rajan (COCO LSUN)
Rajan (only COCO)
0.3
20-
40
80 200
WEBP Compression Quality
20
Figure 1. Sensitivity to WEBP Compression. Using the LSUN dataset, which contains WEBP compressed images, as part of the real distribution makes the network highly vulnerable to WEBP compression.
Fake Score
Real Score Distributions of Corvi
LDM (4-channel Autoencoder)
Flux (16-channel Autoencoder]
80
Frequency
confuses WEBB-compressee fake images with real images, and if this confusion is driven by the inclusion of LSUN images in the real distribution. To do so, we adopt the ex- perimental setup proposed by Rajan et al. (2025), where fake images are generated by reconstructing real images through the LDM (Rombach al., 2022) autoencoder. We train two detectors: one that includes LSUN images in the real distribution and another that excludes them, training only COCO images. For testing, we use 500 real images from the Redcaps dataset (Desai et al., 2021) and 500 fake images generated by Stable Diffusion 1.5. Various levels of WEBP compression are applied to the fake images, while the real images remain uncompressed. We evaluate the average precision (AP), where drop in AP with increas- ing compression levels would suggest that the detector is confusing WEBP-compressed fake images with real ones.
20-
0
-00
-70
-50
-40
-30
-20
Real
Figure 2. Image Quality- Spurious Features. Corvi out- puts a higher real score for Flux reconstructions compared to LDM reconstructions demonstrating the spurious nature these real fea- tures. Fake Score reduces due to the use of different generator.
presence of certain fine details with real images. However, this hypothesis does not hold, Dai et al. (2023) also show that 16-channel autoencoder-basee models, such as FLUX, can reconstruct such details, indicating these features do not determine if an image is real. We highlight a similar issue with Corvi (Corvi et al., 2023).
Analysis: The results of the experiment are shown in Fig. In the training data, LSUN images are WEBP compressed, while the fake images lack WEBP artifacts. This dataset im- balance leads the detector associate WEBP compression with real images, evidenced by the drop in AP as WEBP Compression Quality decreases (i.e., there is more WEBP compression). Excluding the LSUN images mitigates this issue. However, such details will not always be known, making it challenging to filter the data effectively. Thus, an algorithm needed to eliminate spurious correlations associated with the real distribution.
Real and Fake Score: the detector associates with real images also appear in fake images from the same generator family, influencing the detector's 's decision. To achieve this, we first develop a method to measure the impact of these artifacts on the detector's decision.
We aim demonstrate that artifacts
Consider a trained fake image detector as described in Sec- tion 2.2. Given an arbitrary fake image x, define the extracted feature as h (x)(()), h E Ry Where is the ReLU activation. Our final network output can be written as follows,
3.2. Case Study 2: Beyond Post-Processing Artifacts
We next argue that any pattern the detector associates with the real distribution could be spurious. We begin by explain- ing intuition.
fo(x) o(
Σ w,h; w;20
Σ Ew,h;
w.
+b)
Hypothesis: Consider detector trained on real images versus LDM-generated fake images. Models based on 4- channel autoencoders, like LDM, struggle to reconstruct fine details in real images, such as text, as noted by prior work (Dai et al., 2023). As result, the detector may associate the
Increases sum, fakeness
Decrenses sum, realness
We assume that a fake image x is associated with the label whereas a real image has the label 0. We also assume that the final score (added with the bias) is passed through
3

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
1
2
Train Fake Image Detector
Re-train the last layer
Features found In Fake images
ReLU
on Attributes
ReLU
ReLU
ReLU
ReLU
ReLU
Features found Real images
ReLU
Ignore Real Features
9 Φ
g
Frozen Backbone
Figure 3. Our key idea involves 2 steps. (1) We first train fake image detector in the standard way without any modifications. This detector focuses on both real and fake features. (2) We re-train the last layer of the network such that it only focuses on the fake features make decision.
a monotonically increasing sigmoid function, therefore we can infer that the final score, represented as w"',, for an ideal detector must be higher for a fake image than for real image. Our use of the ReLU activation ensures that the extracted feature vector h is vector with only non-negative values. Based on this, for dimension i, if w; < 0, we can conclude that the weighted contribution w.h; S 0. This operation reduces the final score, thus making the image more likely to be classified as real. Similarly, if w; 0, the presence' of this feature h; increases the likelihood of the image being classified as fake. Based on this, we can define score which quantifies the presence of real and fake features in an image.
ages generated by FLUX. Furthermore, compared to LDM- generated fake images, FL.UX gennerated images have signif- icantly lower fake scores (top plot). As result, the majority of decisions for FLUX-generaan images influenced by the presence of real features, supporting argument.
4. Stay-Positive: Learning to Ignore Real Features
In Section 3, showed that associating specific patterns with the real distribution can undermine the detector's 's effec- tiveness. Building on this, we argue that an image should be classified as fake if it contains artifacts linked to the genera- tive model of interest, while the absence of these artifacts indicates that the image is real. Consequently, we require algorithm that forces the detector to focus solely on the patterns associated with the fake distribution. This intuition is illustrated in Figure 3.
Real Score
Σ wF<0 <0
w.
Fake Score
Σ wyh, w,50
Corvi (trained on LDM-generated im- ages) struggles with detecting FL.UX. dev (L.bbs) generated images. To investigate the cause, we use 3,000 real images from the COCO dataset, which were also part of Corvi's training. Since Corvi was trained on LDM-generatee im- ages, we reconstruct these images using the autoencoders of both LDM and FLUX. -dde.. Importantly, both LDM and FLUX reconstructions have the same semantic content, differing only in autoencoder capability. Our aim is to show that Corvi assigns a higher "real" score to FLUX-generatte images compared L.D-ggeneated images, indicating that features associated with real images are also present in fake images generated by FLUX, which belongs to the same generator family as LDM.
Experiment Details:
Real and Fake Features: Fundamentally, the presence of a real feature in an image should increase the likelihood of the detector classifying the image as real. In Section 2.2, under certain assumptions, we demonstrated that the sign of the weights corresponding to each feature be used to determine whether the presence of that feature enhances the probability of an image being classified as real. Specifically, the indices of h that are multiplied by positive values of w correspond to fake features Iakee while the indices multi- plied by negative values of w correspond to real features Treal- We formalize this below,
Irall = {i w. 0}, Irak (i w. 0).
The results are presented in Fig. 2. The real scores of ILUUX-generall images (bottom plot) are often higher in magnitude than those of LDM-generated images. This is problematic, as it suggests that features associated with real images by Corvi are also present in fake im-
Analysis:
This perspective allows to train the detector to focus only the features that distinguish fake images.
Stsy-Positive to Ignore Real Features: Based on our anal- ysis in Section 3.2, we aim for the real score to be 0 for all images. By definition, avoiding negative connections in the last layer guarantees this outcome. We achieve this
presence of feature refers hy having a non-zero value, as apposed to absence where would have value.

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Algorithm Re-training the last-layer while staying posi-
Scores Across Models
tive
1.0
Input: Pretrained Dø. learning rate 17, iterations T Initialize w = 0, b 0
Average Precision
0.9
0.8
0.7
Freeze 9d
0.6
Corvi
for t 1 to T" do
0.5
Corvi (Ours)
Sample fxi, Yi fiml
Rajan
0.4
Rajan (Ours)
h ((g((:))
# where yy denotes ReLU
0.3
fo (x:)= o(w h, +
20
60
80
100
WEBP Compression Quality
C = - (og(f((x;)
(1 - 34) log(1 - fo((i))
w +- w- V/
Figure 4. Improved Robustness to WEBP Compression. Com- pared the original Corvi and Rajan, our detectors Corvie and RajaneB show increased robustness towards WEBP Compression.
b < b- - Vo
w < max(w, 0)
end for Output: w,b b
5.1. Mitigating Post- Post-Processing based Spurious Correlations
by constraining the last-layer weights during optimization, overwriting any negative values with zero. This ensures that the network relies solely on Take to fit the training data. In our experiments, we found that training the entire network with this constraint negatively impacted the classification accuracy of real images. We report these results in Section 5.5. We hypothesize that when the entire network is trained, may learn to link the absence of spurious real features to fake images, using negations. We discuss this further in Appendix A.6. To avoid this, perform last-layer re- training instead. The details are outlined in Algorithm 1. The algorithm illustrates a simple SGD update, though it is independent of the optimizer used.
5.1.1 COMPRESSION-BASED ARTIFACTS
Both Corvi and Rajan suffer from the spurious correlations studied in Section 3.1, where WEBP compressed images are detected as real images.
To study the sensitivity of Corvi (Ours) and Rajane (Ours) to WEBP compression we utilize the same setting used in Section 3.1.
Experiment Details:
We report the results in Figure 4. Compared to Corvi and Rajan, our detectors are much more robust to WEBP compression. Additionally, our detectors, while ignoring real features, are still able to separate generated images from real images, as indicated by the AP scores. It is important note that our solution does not require any prior knowledge about specific spurious features, unlike data augmentation-bast solutions.
Analysis:
We use validation accuracy to select the model and deter- mine the stopping condition, as outlined in Appendix A.I.
5. Experiments
1.1.2. RESIZING-BASHI ARTIFACTS
In this section, we evaluate whether ignoring real features can improve the performance of existing detectors. We con- sider the following state-of-the-art baselines: The Corvi detector (Corvi et al., 2023), which is based on a ResNet-50 network trained on real images from MSCOCO and LSUN, and fake images generated by LDM with prompts corre- sponding to the real data. Similarly, the Rajan detector (Rajan et al., 2025) uses the same real images as Corvi, but instead trains on fake images generated by LDM reconstruc- tions of the real images.
Corvi struggles with downsized fake images, as noted by Rajan et al. (2025). This issue arises from the data augmenta- tion strategy used during training, where real images, which typically have higher resolutions, are randomly cropped and downsized to 256x256. This augmentation causes the detec- tor to associate downsizing with real images. We also repeat this experiment using images from the Synthbuster dataset (Cozzolino et al., 2024), details of which can be found in Appendix A.3.
Experiment Details: With this experiment, we want to com- pare the robustness of Corvie (Ours) with the original Corvi with respect to downsizing. To do so, we randomly select 500 real images from whichfaceisseal (whi) and generate fake images using SDv2.1. All images have resolution of 1024x1022 We downsize the fake images to different scales and plot AP vs. the scaling factor.
Both detectors are trained using the best practices suggested by Gragnaniello al. (2021), with details provided in Ap- pendix A. We apply Algorithm 1 to both detectors while using the same datasets as Corvi and Rajan. The result- ing detectors are referred to as Corvie (Ours) and Rajano (Ours). We also conduct some of these experiments with de- tectors trained on GAN-generated images, and these results are included in Appendix A.7.
Analysis: We plot AP with respect to the scaling factor in
5

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Table AP of existing defectors before and after last-layer retraining. The large improvements on FLUX and aMUSEd suggest that existing detectors are harmed by spurious correlations unrelated to post-procsssing, which our algorithm circumvents. Additionally, on settings where Corvi, Rajan already perform well, our method performs the same not slightly better. AVG is the equally weighted AP average across all generators.
METHOD
SD
MJ
KD
PG
PIXART
LCM
FLUX
WUERSTCHEN
AMUSED
AVG
CORVI
99.97
99.46
99.98
97.42
99.99
99.94
57.25
100
89.18
94.23
CORVI (OURS)
99.98
99.79
99.99
99.99
99.99
99.99
99.33
99.99
99.80
99.88
RAJAN
99.89
99.90
99.98
99.94
100
99.99
80.64
95.13
87.20
96.22
RAJANO (OURS)
99.99
99.93
99.99
99.99
99.99
99.99
90.50
97.99
98.11
98.65
(Pernias et al., 2023); x. aMUSEd: 3,150 images from Amused/amused-512 (Patil et al., 2024).
AP Scores Across Models
1.0
Average Precision
The dataset includes the latest latent space models: aMUSEd (autoregressive) and others (diffusion//low-brt -aased............ We gen- erate images for FLUX, Wuerstchen, and aMUSEd, while the rest come from Rajan et al. (2025)'s test set. The real im- age set covers scenery, art, and faces, with post-processing (compression, resizing, color jitter) to ensure diversity. We demonstrate that our selected real image dataset, represents wide range of real image types in Appendix A.2. We aim to show that base detectors, Corvi and Rajan, also learn spurious real features unrelated to post post-processing, harm- ing performance. To ensure our experimental results are free from these effects, we use fake images that haven't t undergone any post-processing.
0.8
0.6
Corvi
Corvie (Ours)
0.3
0.6
Scaling Factor
Figure 5. Improved Robustness to Downsizing, Compared to the original Corvi, our Corviè shows increased robustness towards downsampling.
Figure 5. By training on the same dataset, Corvie (Ours) is much more robust to downsizing operations in comparison to Corvi. Similar to the case of WEBP compression, we are able to mitigate spurious correlation without using information about the cause.
5.2.2. DISCUSSION
We present the AP values for the original Corvi and Rajan, alongside our versions incorporating last-layer retraining, in Table 1. Our methods show substantial improvements in AP on FL. -..X--geeertted images. Corvi (Ours) and Rajan (Ours) outperform the original detectors by 42.08 and 9.86, respectively, on FLUX, and by 10.62 and 10.91, respectively, aMUSEd. As our fake images lack post-processing ar- tifacts, the performance gap is likely due to the spurious correlations discussed in Section 3.2. These improvements suggest that while the original detectors can identify fea- tures distinguishing fake images from FLUX and aMUSEd, learning real features hinders the detection of these fake images. Importantly, settings where Corvi and Rajan perform well (c.g.. SD, KD, LCM), our method matches outperforms them, showing that the detector does not lose performance by ignoring real features. The rightmost column reports the mean average precision aggregated over all settings.
5.2. Mitigating other Spurious Correlations
Section 3.2 discussed how real features can affect gener- alization. In this section, we test if Corvi (Ours) and Rajane) (Ours) improve over the original versions.
5.2.1. DATASET
To test our hypothesis, we use the following dataset: i. Real: 6,000 images from Redcaps (Desai et al., 2021), (?), and whichfaceis-
WikiArt (wik), LAION-Aesthere real (whi), including 3,000 post-processed images. ii SD: 3,000 images from SDv1.5, InstructPix2Pix (Brooks et al., 2023), and Nights (Fu et al., 2023); iii. MJ: 3,000 im- ages from MidJourney v4 and v5 (mid); iv. Kandin- sky: 3,100 images from Kandinsky 2.1 (Razzhigaev al., 2023); PG: 3,150 images from Playground v2.5 (Li et al., 2024); vi. PixArt: 3,150 images from PixelArt-ar (Chen et al., 2024b); vii. LCM: 3,146 images from Simian- Luo/LCM Dreamshaeaepprrr...mmmm..a..aa.. v7 (Luo et al., 2023); viii. FLUX: (Labs); ix. Wuerstchen: 3, 150 images from warp-ai/wuerstchen
5.3. Comparison with State-of-the-AAt Fake Detectors
Next, we compare the performance of our detector with state-of-the-art fake detection methods. We use the same dataset from Section 5.2, but to simulate a rorl-world set-
3,000 images from Black-Forest-Lang Laarsst-ab//FLUXX.-1
6

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
ting, We create post-processed versions of the fake images. For FLUX, Wuerstchen, and aMUSEd, we randomly apply compression, resizing, and color jittering, and add these modified images to the dataset. Images for the other models are taken from the dataset provided by Rajan et al. (2025). Additionally, we evaluate our detector on the widely used Genlmage benchmark (Zhu et al., 2024), with results pre- sented in Appendix A.4, as well as on latent diffusion and autoregressive models from the UFD benchmark (Ojha et al., 2023), with results shown in Appendix A.5.
Original
200
230
5.3.1. BASELINES
Figure 6. Example of an image which has been recursively in- painted. The first/sccond row shows the inpainted image and the inpainted region, respectively.
From the family of zero-shot fake image detectors we select i. AEROBLADE (Ricker et al., 2024). From the CLIP linear- shearrproobig paradigm, we select: ii UFD-ProGAN (Ojha et al., 2023): trained on ProGAN images, represent- ing the baseline method in this paradigm; iii. UFD-LDM (Ojha et al., 2023): trained on LDM images, extending the original setup to a different generative domain; iv. ClipDet: a follow-up work by Cozzolino et al. (2024) that refines the linear- peeear-poobigggeee approach for LDM images. Additionally, we include v. DRCT: a recent method by Chen et al. (2024a) that employs DDIM inversion to reconstruct both real and fake images, combined with a contrastive training objective for better generalization, using ConvNext (Liu et al., 2022) backbone trained on images from SDv1.4. .4. We also com- pare against the original Corvi and Rajan, the detectors on which our method is based, to benchmark the improvements our approach introduces.
5.4. Improved Detection of Partially Inpainted Images
Prior experiments consider fake images that are completely generated. However, a user can take real images and par- tially modify them. While most regions of such images are "real", they could be created with malicious intent, making their detection important. Intuitively, detectors that depend on real features would struggle to detect these modified im- ages, since a portion of these images is real. Here, we study the sensitivity of our approach to such images.
5.4.1. EXPERIMENT DETAILS
We use the Stable Diffusion inpainted dataset from Conde et al. (2024), where real image is modified by masking and inpainting a region. Following Conde et al. (2024), we group images by the percentage of inpainted pixels. In recursive inpainting (refer Fig 6), the same region can be inpainted multiple times, so the number of inpainted pixels may exceed the total (c.g., 150%). Each group has 300 inpainted images. We calculate AP with respect to the 6000 real images from Section 5.2.
5.3.2. DISCUSSION
We present our results in Table 2 and observe that detectors relying on full-network fine-tuning, such as DRCT, Corvi, and Rajan, along with our improved baselines, outperform and zero-shot approaches. In comparison to Corvi, our Corvis (Ours) shows large improvements. On PG and FLUX generated images, our version outperforms the original Corvi by 6.47 and 19.66 respectivel.. On FLUX generated images, our version outperforms the original Ra- jan by 4.05. Notably, the AP scores of the original Corvi and Rajan on FLUX and aMUSEd improve compared to the values reported in Table 1, indicating that post-processed fake images from these generators were actually easier to detect compared to fake images without post-processing. This suggests that the fake images used in Table contain artifacts that harm the performance of Corvi and Rajan. Post-processing these images can remove these artifacts, improving both detectors' performance. Given their sensi- tivity to post-procsssing, these are likely low-level artifacts affecting detector performance, similar to those described in Section.3.2. Unlike the original Corvi and Rajan, our versions are unaffected by such discrepancies.
5.4.2. ANALYSIS
We report our results in Table 3. At the 50-level, all ap- proaches barring Corvic and Rajano fail to detect these inpainted images. This is perhaps unsurprising since these images are "real" for the most part. Our detectors on the other hand, do not suffer from these issues as indicated by the AP score. The performance of Corvi and Rajan improves with more inpainting, highlighting the harmful impact of real features on their performance.
5.5. Ablations
In this section, we ablate other possible alternatives to final- layer re-training. We experimented with two other variants, (i) clamped (no retrain) where we clamp the detector's s weights to stay-positive without re-training the whole net- work and (ii) + clamped (retrain): where we re-train the whole network with the stay-positive algorithm applied on
7

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Table AP state-of-the-ar" detectors on post-processed fake images. Methods trained by our algorithm, Corvi and Rajan outperform their base detectors as well as other of the detection approaches on recent generators such as FLUX and Wuerstchen. Additionally, on settings where Corvi, Rajan already perform well, our method performs the same if not slightly better. AVG the equally weighted AP average across all generators.
Method
SD
MJ
KD
PG
PixArt
LCM
FLUX
Wuerstchen
aMUSEd
AVG
AEROBLADE (Ricker et al., 2024)
90.81
96.48
94.03
71.53
87.84
89.99
60.34
85.93
88.39
85.03
UFD-ProGAN (Ojha et al., 2023)
61.93
61.72
74.88
70.23
69.81
70.86
37.54
86.30
88.84
64.73
UFD-LDM (Ojha et al., 2023)
62.02
52.33
65.33
62.36
62.39
65.52
35.18
86,46
90.98
69.12
ClipDet (Cozzolino et al., 2024)
71.63
73.72
74.71
75.53
76.61
72.06
81.48
90.11
87.61
18.16
DRCT (Chen al., 2024a)
96.09
90.74
95.86
83.83
78.39
88.43
76.60
85.40
87.87
87.02
Curvi (Corvi et al., 2023)
97.87
94.81
95.38
91.40
94.45
96.33
74.57
95.83
94.57
92.80
Corvic (Ours)
98.94
94.92
97.71
97.87
98.59
98.73
94.23
98.16
95.47
97.17
Rajan (Rajan et al., 2025)
99.40
98.30
98,18
98.62
98.64
99.79
87,80
94.51
95,38
96.73
Rajane: (Ours)
99.22
96.98
98.22
98.53
99.11
99.57
91.85
94.74
97.26
96.96
fake distribution. We find that Corvi (Ours) exhibits a similar issue. To illustrate this, we take 500 Redeaps images (512x512), upsample them, and analyze how their upsam- pled versions affect the logit score. As shown in Fig. 7, we can that upsampled images
Table 3. AP on partially-inpainted fake images, Corvi and Rajan struggle detect partially-inpaineed fake images, as they focus real image features. Our detectors overcome this limitation.
METHOD
50%
100%
150%
more likely to be clas- sified as fake. Despite the improvements we demonstrate, we emphasize that greater care must be taken when curating the set of real and fake images to avoid such behavior.
CORVI
6.13
83.36
98.05
CORVIO (OURS)
97.48
99.92
99.98
RAJAN
49.69
99.93
100
RAJAN (OURS)
99.66
99.99
100
Our method encourages the detector to ignore features that are specific to real images. However, after the first stage of training, these features can still implicitly influence the detector's understanding of what constitutes fake. For example, the model may learn that the absence of certain real-specific cues is indicative of a fake image, effectively using real image features in a negative sense. We observe such behavior in our own detector. To illustrate this ef- feet, we include simple toy example in Appendix A.6. These limitations suggest that better generalization could be achieved by extending this approach to train the entire network, as opposed to just the final layer.
the final layer. We calculate the average precision (AP) and report the values in Table 4.
We evaluate these ablated models under the same setting described in Section 5.3. Our results, similar to those in Table 2, show that clamping without retraining leads to sub- optimal performance, likely due to improper reweighting of fake features. Training the entire backbone while clamping the final layer underperforms FLUX images, likely due to the emergence of newly learned spurious fake features as discussed in Appendix A.6.
7. Related Work
5.6. Robustness to other Post-Processing Artifacts
Training- methods create effective fake image detec- tors. Wang et al. (2020) demonstrated that data augmenta- tions during training improve generalization. Odena et al. (2016) demonstrated identifiable artifacts, like checkerboard patterns, in the Fourier transforms of fake images. Build- ing on this, Zhang et al. (2019) trained on Fourier images, leading to improvements. Chai et al. (2020) improved de- tection using patch- based classification. Gragnaniello et al. (2021) removed downsampling in the initial layers and ap- plied patch-wise training for further gains. These techniques were extended to the LDM setting by Corvi et al. (2023). Additionally, works such as Chen et al. (2024a) and Rajan et al. (2025) also use reconstructions of real images as part of the training data. These approaches struggle to general-
We also conduct tests testing the senstitivty of our detector to post-processing operations. We use JPEG Compression, additive gaussian noise and low-pass filtering to account for some of the common post-processing operations. We report our results in Appendix A.3.
6. Limitations
Our approach enhances existing detectors by ensuring that the final layer ignores features associated with the real distri- bution. However, patterns linked to the fake distribution can also be spurious. For instance, Rajan et al. (2025) observed that Corvi incorrectly associates upsampled images with the
8

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Table AP for different ablations. We experiment with different ways applying the stay-positive algorithm. We observe that both settings, freezing the backbone of the network while re ve-training the last-layer performs the best. AVG is the equally weighted AP average across all generators.
Method
SD
MJ
KD
PG
PixArt
LCM
FLUX
Wuerstchen
aMUSEd
AVG
Corvi
97.87
94.81
95.38
91.40
94.46
96.33
74.57
95.83
94.57
92.80
Corvi + clamped (no retrain)
85.75
76.44
85.41
82.28
93.21
85.12
63.60
85.71
66.70
80.47
Corvi + clamped (retrain)
98.93
95.38
95.42
97.64
94.98
95,54
69.50
96.76
95.80
93.33
Corvig (Ours)
98.94
94.92
97.71
97.87
98.59
98.73
94.23
98.16
95.47
97.18
Rajan
99.40
98.30
98.18
98.62
98.64
99.79
87.80
94.51
95.38
96.73
Rajan + clamped (no retrain)
95.01
90.83
92.72
94.57
98.87
96,50
70.47
81.71
72.85
88.17
Rajan clamped (retrain)
99.19
96.30
95.49
98.66
95.93
96.95
58.68
88.73
94.66
91.62
Rajans (Ours)
99.22
96.98
98.22
98.53
99.11
99.57
91.85
94.74
97.26
97.28
ize across architectures. To address this, Ojha et al. (2023) proposed using general-purpose visual encoders like CLIP (Radford et al., 2021) for fake image detection. Unlike ours, these methods explicitly rely on real features.
Real Images
1.0
Corvi
Logit Score
0.6
Contrary to prior approaches, GenDet (Zhu et al., 2023) treats fake image detection as an anomaly detection prob- lem, similar to ours, but focuses on learning the real image distribution. Another paradigm suggests generators recon- struct fake images more easily than real ones. For recon- struction, Pasquini et al. (2023) use GAN inversion (Xia et al., 2022), DIRE (Wang et al., 2023), ZeroFake (Sha et al., 2024) apply DDIM inversion (Song et al., 2021), and AER- OBLADE (Ricker et al., 2024) leverages a latent diffusion autoencoder. However, these methods at times struggle with detecting post-processed images (Rajan et al., 2025). A contrasting approach, akin to image reconstruction, was re- cently proposed by Cozzolino et al. (2025), who use neural image-compression networks (Cao et al., 2020) to model real distribution likelihood, assuming fake images are less likely to be part of it. While this method models the real distribution, argue the focus should be on detecting fake image artifacts instead.
0.2
0.0
1.0
1.2
1.4
1.6
1.8
2.0
Scaling Factor
Figure 7. Vulnerability to Spurious Fake Features. Our method Corvi is not able to mitigate spurious correlations pertaining to the fake distribution, where just like the original Corvi, it continues to associate upsampled images with the fake distribution.
vual-ditrribttinn features, the model reduces susceptibility to spurious correlations, enhancing robustness. Additionally, models trained this way excel on partially inpainted real images. While this work focuses on detecting Al-generated images, we believe that our core idea - that specific pat- terns should not be associated with the real distribution could be applicable to other forms of media forensics, such audio and video. We leave these directions future re- search. We hope our study contributes developing more robust detectors with positive societal impact.
In the literature on mitigating spurious correlations, two- stage training strategies have been previously proposed. Liu et al. (2021) select samples with high training loss in the first stage and re-train the network on these samples in the second stage. Kirichenko et al. (2023) employ last-layer re- training in a strategy. However, while these approaches rely on data curation in the second stage to force the network to focus on relevant features, our approach instead constrains the network architecture itself, encouraging it to focus on patterns that are present in fake images.
A Acknowledgements
This work was supported in part by NSF IIS2404180, Amer- ican Family Insurance, and Institute of Information & communications Technology Planning & Evaluation(IITP) grants funded by the Korea governmen((MSIT) (No. 2022- 0-00871, Development of AI Autonomy and Knowledge En- hancement for Al Agent Collaboration) and (No. RS2022- 00187238, Development of Large Korean Language Model Technology for Efficient Pre-training).
8. Conclusion
We showed that learning patterns from the real distribu- tion can harm fake image detection and propose a last-layer the-tuning strategy to improve performance. By ignoring

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Impact Statement
Cozzolino, D., Poggi, G., Corvi, R., Nießner, M., and Verdo- liva, L. Raising the Bar of Al-generated Image Detection with CLIP. In CVPRW, 2024.
This paper aims to advance the field of fake image detection, with focus on security and potential societal benefits, such as curbing misinformation. However, may also provide bad actors with insights into recent developments in image forensics and expose vulnerabilities in existing systems.
Cozzolino, D., Poggi, G., Nießner, M., and Verdoliva, L. Zero-shot detection of ai-generated images. In ECCV, 2025.
Dai, T., Cai, J., Zhang, Y., Xia, S.-T., and Zhang, L. Second- order attention network for single image super-resolution. In CVPR, 2019.
References
Midjoumny. http://wwww.miijounee.ccomm
Dai, X., Hou, J., Ma, Tsai, S. S., Wang. J., Wang, R., Zhang. P., Vandenhende, S., Wang. X., Dubey, A., Yu, M., Kadian, A., Radenovic, F,, Mahajan, D., Li, K., Zhao, Y., Petrovic, V., Singh, M. K., Motwani. S., Wen, Y., Song, Y., Sumbaly, R., Ramanathan, V., He, Z. Vajda, P., and Parikh, D. Emu: Enhancing image generation models using photogenic needles haystack. CoRR, 2023.
Which face is real? http::/wwww.whhiffficcccral...l
Wikiart. https:/wwww.wikkiar.oog
Brock, A., Donahue, J., and Simonyan, K. Large scale GAN training for high fidelity natural image synthesis. In ICLR, 2019.
Brooks, T., Holynski, A., and Efros, A. A. Instructpix2pix: Learning to follow image editing instructions. In CVPR, 2023.
Desai, K., Kaul, G., Aysola, Z., and Johnson, J. RedCaps: Web-curated image-text data created by the people, for the people. In NeurIPS Datasets and Benchmarks, 2021.
Dhariwal, P. and Nichol, A. Q. Diffusion models beat GANs image synthesis. In NeurIPS, 2021.
Cao, S., Wu, C.-Y,, and Krähenbühl, Lossless image compression through super-resolution. arXiv preprint arXiv:2004.0288 02872, 2020.
Esser, P., Kulal, S., Blattmann, A., Entezari, R., Müller, J., Saini, H., Levi, Y., Lorenz, D., Sauer, A., Boesel, F., et al. Scaling rectified flow transformers for high-resolution image synthesis. In ICML, 2024.
Chai, L., Bau, D., Lim, S.-N., and Isola, What makes fake images detectable? understanding properties that generalize. In ECCV, 2020.
Fu, S., Tamir, N., Sundaram, S., Chai, I.., Zhang, R., Dekel, T., and Isola, P. Dreamsim: Learning new dimensions of human visual similarity using synthetic data. arXiv preprint arXiv:2306.099 09344. 2023.
Chen, B.. Zeng, J., Yang, J., and Yang, R. Dret: Diffu- sion reconstruction contrastive training towards universal detection of diffusion generated images. In ICML, 2024a.
Chen, J., YU, J., GE, C., Yao, L., Xie, E., Wang, Z., Kwok, J. Luo, P., Lu, H., and Li, Z. Pixart-S', allpha: Fast training of diffusion transformer for photorealistic text- to-image synthesis. In ICLR, 2024b.
Goodfellow, I. J., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. Generative adversarial nets. In NeurlPS, 2014.
Gragnaniello, D., Cozzolino, D., Marra, F., Poggi, G., and Verdoliva, L. Are gan generated images easy to detect? critical analysis of the state-of-the-an In ICME, 2021.
Chen, Q. and Koltun, Photographic image synthesis with cascaded refinement networks. In ICCV, 2017.
Choi, Y., Choi, M., Kim, M., Ha, J.-W., Kim, S., and Choo, J. Stargan: Unified generative adversarial net- works for multi-domain image-to-image translation. In CVPR, 2018.
Grommelt, P., Weiss, L., Pfreundt, F.-J,, and Keuper, Fake jpeg? revealing common biases in generated image de- tection datasets. arXiv preprint arXiv:2403. 2024.
Gu, S., Chen, D., Bao, J., Wen, F., Zhang, B., Chen, D., Yuan, L., and Guo, B. Vector quantized diffusion model for text-to-image synthesis. In CVPR, 2022.
Conde, J., González, M., Martínez, G., Moral, F., Merino- Gómez, E., and Reviriego, P. How stable is stable dif- fusion under recursive inpainting (rip)? arXiv preprint arXiv:2407.09549, 2024.
He, K., Zhang, X., Ren, S., and Sun, Deep residual learning for image recognition. CVPR, 2016.
Corvi, R., Cozzolino, D., Zingarini, G., Poggi, G., Nagano, K., and Verdoliva, L. On the detection of synthetic images generated by diffusion models. In ICASSP, 2023.
Karras, T., Aila, T., Laine, S., and Lehtinen, J. Progressive growing of GANs for improved quality, stability, and variation, In ICLR, 2018.
10

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Karras, T., Laine, S., and Aila, T. A style-based genera- tor architecture for generative adversarial networks. In CVPR, 2019.
Ojha, U., Li, Y., and Lee, Y. J. Towards universal fake image detectors that generalize across generative models. In CVPR, 2023.
Karras, T., Laine, S., Aittala, M., Hellsten, J., Lehtinen, J., and Aila, Analyzing and improving the image quality of stylegan. In CVPR, 2020.
Park, T., Liu, M.-Y., Wang, T.-C., and Zhu, J.-Y. Semantic image synthesis with spatially- normalization. In CVPR, 2019.
Kirichenko, P., Izmailov, P., and Wilson, A. G. Last layer re-training is sufficient for robustness to spurious correla- tions. In ICLR, 2023.
Pasquini, C., Laiti, F., Lobba, D., Ambrosi, G., Boato, G., and De Natale, F. Identifying synthetic faces through gan inversion and biometric traits analysis. Applied Sciences, 2023.
Labs, B. F. Fluxl. hutps//blaackforestlbbbaa/
Patil, S., Berman, W., Rombach, R., and von Platen, P. amused: An open muse reproduction. arXiv preprint wrXiv2441.01880 2024.
Li, D., Kamko, A., Akhgari, E.,, Sabet, A., Xu, I.., and Doshi, S. Playground v2. 5: Three insights towards enhancing aesthetic quality in text-to-image generation. arXiv preprint arXiv:2402.17245. 2024.
Pernias, P., Rampas, D., and Aubreville, M. Wuerstchen:
Efficient pretraining of text-to-image models. 2023.
Li, K., Zhang, T., and Malik, J. Diverse image synthesis from semantic layouts via conditional imle. In ICCV, 2019.
Podell, D., English, Z., Lacey, K., Blattmann, A., Dockhorn, T., Müller, J., Penna, J., and Rombach, R. SDXL: Im- proving latent diffusion models for high-resolution image synthesis. In ICLR, 2024.
Lin, T.-Y., Maire, M., Belongie, S., Bourdev, L., Girshick, R., Hays, J., Perona, P., Ramanan, D., Zitnick, C. L., and Dollár, P. Microsoft coco: Common objects in context, 2015.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., al. Learning transferable visual models from natural language supervision. In JCML, 2021.
Lipman, Y., Chen, R. T., Ben Ben-Hamu, H., Nickel, M., and Le, M. Flow matching for generative modeling. ICLR, 2022.
Rajan, A. S., Ojha, U., Schloesser, J., and Lee, Y. J. Aligned datasets improve detection of latent diffusion diffusion-generated images. In ICLR, 2025.
Liu, E. Z., Haghgoo, B., Chen, A. S., Raghunathan, A., Koh, W., Sagawa, S., Liang, P., and Finn, C. Just train twice: Improving group robustness without training group information. In ICML, 2021.
Ramesh, A., Pavlov, M., Goh, G., Gray, S., Voss, C., Rad- ford, A., Chen, M., and Sutskever, Zero-shot text-to- image generation. In ICML, 2021.
Liu, X., Gong, C., and qiang liu. Flow straight and fast: Learning to generate and transfer data with rectified flow. In ICLR, 2023.
Razzhigaev, A., Shakhmatov, A., Maltseva, A., Arkhip- kin, V., Pavlov, I., Ryabov, I., Kuts, A., Panchenko, A., Kuznetsov, A., and Dimitrov, D. Kandinsky: an improved text-to-image synthesis with image prior and latent diffu- sion. arXiv preprint arXiv: 2023.
Liu, Z., Mao, H., Wu, C.-Y., Feichtenhofer, C., Darrell, T., and Xie, S. A convnet for the 2020s. In CVPR, 2022.
Luo, S., Tan, Y., Huang, L., Li, J., and Zhao, H. La- tent consistency models: Synthesizing high-resolution images with few-step inference. arXiv preprint arXiv:2310.04378, 2023.
Ricker, J., Lukovnikov, D., and Fischer, A. Aeroblade: Training- free detection of latent diffusion images using autoencoder reconstruction error. In CVPR, 2024.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. In CVPR, 2022.
MindSpore.
wukong.
Nichol, A. Q., Dhariwal, P., Ramesh, A., Shyam, P., Mishkin, P., Megrew, B., Sutskever, I., and Chen, M. Towards photorealistic image generation and editing with text-guided diffusion models. In JCML, 2022.
Rossler, A., Cozzolino, D., Verdoliva, L., Riess, C., Thics, J., and Nicßner, M. Faceforensics++: Learning to detect manipulated facial images. In ICCV, 2019.
GLIDE:
Schuhmann, C., Beaumont, R., Vencu, R., Gordon, C. W., Wightman, R., Cherti, M., Coombes, T., Katta, A., Mullis, C., Wortsman, M., Schramowski, P., Kundurthy, R.,
Odena, A., Dumoulin, V., and Olah, C. Deconvolution and checkerboard artifacts. Distill, 1110)e3, 2016.

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Crowson, K., Schmidt, L.., Kaczmarezyk, R., and Jitsev, J. LAION-5b: An open large-scale dataset for training next generation image-text models. In NeurlPS Datasets and Benchmarks Track, 2022.
Sha, Z., Tan, Y., Li, M., Backes, M., and Zhang, Y. Zerofake: Zero-shot detection of fake images generated and edited by text-to-image generation models. In ACM SIGSAC Conference on Computer and Communications Security, 2024.
Sohl-Dickstein, J., Weiss, E., Maheswaranathan, N., and Ganguli, S. Deep unsupervised learning using nonequi- librium thermodynamics. In ICML, 2015.
Song, J., Meng, C., and Ermon, S. Denoising diffusion implicit models. In ICLR, 2021.
Song, Y. and Ermon, S. Generative modeling by estimating gradients of the data distribution. In NeurIPS, 2019.
Vahdat, A., Kreis, K., and Kautz, J. boore-based generative modeling in latent space. NeurlPS, 2021.
Wang, S.-Y., Wang, O., Zhang, R., Owens, A., and Efros, A. A. Cnn-generated images surprisingly easy to spot... for now. In CVPR, 2020.
Wang, Z., Bao, J., Zhou, W., Wang, W., Hu, H., Chen, H., and Li, H. Dire for diffusion-generated image detection. In CCCV,0023
Xia, W., Zhang, Y., Yang, Y., Xue, J.-H., Zhou, B., and Yang, M.-H. Gan inversion: A survey. IEEE transactions on pattern analysis and machine intelligence, 2022.
Yu, F., Seff, A., Zhang, Y., Song, S., Funkhouser, T., and Xiao, J. Lsun: Construction a large-scale image dataset using deep learning with humans in the loop, 2016.
Zhang, X., Karaman, S., and Chang, S.-F. Detecting and simulating artifacts in gan fake images. In WIFS, 2019.
Zhu, J.-Y., Park, T. Isola, and Efros, A. A. Unpaired image-to-image translation using cycle-consistent adver- sarial networks. In ICCV, 2017.
Zhu, M.. Chen, H., Huang, M.. Li. W. Hu, H. Hu, J., and Wang, Y. Gendet: Towards good generaliza- tions for ai- ai-generated image detection. arXiv preprint arXiv:23 02.0880 2023.
Zhu, M., Chen, H. Yan, Q., Huang. X., Lin, G., Li. W., Tu. Z., Hu, H., Hu, J., and Wang. Genimage: A million- scale benchmark for detecting ai- ai-generated image. In NeurlPS, 2024.
12

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
A. Appendix
A.I. Implementation Details
We follow the training recipe used by Corvi et al. (2023). We train on 96 x 96 crops of the whole image using a batch size of 128. The data augmentations include random JPG compression and blur from the pipeline proposed by Wang et al. (2020). Following Gragnaniello et al. (2021), grayscale, cutout and random noise also used as augmentations. Finally, in order make the network invariant towards resizing, the random resized crop added. For the baseline detectors well as re-trained variant, we report the average across two trained networks. When applying Algorithm 1, we use batch size of 1024 to perform last-layer retraining. The rest of the training recipe does not differ from the original model. The second stage training on average converges in about 15 epochs, which takes an additional 4 hours.
We use the validation set provided by Corvi et al. (2023) for our training. Just like our training set, the real images come from COCO/LSUN and the fake images are generated at 256 x 256 using LDM. During training, if the validation accuracy does not improve by 0.1 1% in epochs the learning rate is dropped by 10x. The training terminated at learning rate 10 We adopt this following Wang al. (2020).
During inference, we do not to crop/resize the image to fixed resolution. This is possible since the ResNet-50 uses Spatially-Aaptixe Average Pooling layer before inference.
A.2. Performance on Real Images
When testing our models effectiveness in detecting images coming from various kinds of generators, we use real image dataset which consists of both natural real images (Redcaps), artistic real images (wikiart and -eshN-Aesshetics)) as well as face images (whichfaceisreal). We also post-process the images to simulate a real world setting. However, in this section, we test whether this set of real images truly representative of the multiple real distributions present. In order to verify this, we plot the distributions of various kinds of real images.
A.2.1. DATASET
i. Test Real: 6,000 images previously used in the main paper, containing artistic and natural images. ii GTA: 6,382 GTA landscape images from the IMLE dataset (Li et al., 2019), providing a diverse range of synthetic scenes. iii. ImageNet: 8,000 real images from the Genlmage benchmark, originally part of the ImageNet dataset, to capture standard real-world content. iv. Cubism: 2,235 images in the Cubism style sourced from the WikiArt dataset, adding a distinct artistic domain. v. Pop Art: 1,483 images in the Pop Art style from WikiArt, expanding the artistic domain with vibrant and modern aesthetics. vi. Modern Art: 4,334 images of Modern Art from WikiArt, offering a rich and varied artistic representation.
GTA
Modern Art
Pop Art
Cubism
ImageNet
Figure Example of different kinds real images we consider.
This dataset ensures wide range of testing scenarios, from standard real-world distributions to highly diverse artistic and CG (but not neural network generated) domains. An example of the images used can be found in Figure 8.
A.2.2. RESULTS
We pass the real images through Corvi (Ours) and Rajan (Ours) and plot the logit score (output of the network) in the form of violin plots in Fig 9. We observe that the fakeness scores of our test distribution indicated by "Test Real" is extremely similar to the other distributions of real images such as GTA, Cubism etc. This shows that the test-set which we
13

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Corvi @
Rajan @
0.0
540
0.40
Logit Score
Logit Score
6:50-
0.4
6:30
Test Real
GTA
Cubism
ImageNet
Pop Art Modern Test Real
GTA
Cubism
ImageNet
Pop Art Modern Art
Figure 9. Distribution of different kinds of real images. The violin plots of Corvid (left) and Rajans (right) show that the test set used in our experiments accounts for wide variety of real image types.
use in the main paper representative of various different types of real image families. important note that these real images vastly different, belonging different domains such realistic scenes, styles and video game rendered environments. However, the thing in common is the absence of the generator artifacts which is indicated by the low logit score in these violin plots.
A.3. Robustness Analysis
In the main paper, show that our method shows improved robustness to WEBP Compression and downsizing. In this section, we test the robustness of our detector to JPEG Compression, additive gaussian noise and low-pass filtering, For IPEG and additive noise, we follow the same experimental setting adopted by Rajan et al. (2025). Instead of AP, we report the logit scores. This way, we study the behaviour of the detector on both post-processed real and fake images,
We report the results from robustness tests Fig 10. We can observe that our variants perform similar to the original models, which is not surprising since all of these perturbations were seen during training. Additionally, our real distribution shows very little variance unlike the distribution of the original baselines since method does not rely specific features to call image real. Additionally, we also test the robustness to resizing using the SynthBuster dataset (akin to Fig from Cozzolino et al. (2024)) and we report our results in Fig 11.
A.4. Performance on GenImage
1.4.1. EXPERIMENTAL SETUP
In this section, evaluate the performance of various detectors the GenImage benchmark (Zhu et al., 2024). We consider the same baselines which we use in Section 5.3. The scope of our work is detecting images from the same kind of generative model (latent diffusion models), therefore we consider the Genlmage testsets from Midjourney (mid), VQDM (Gu et al., 2022), 1Dv1.4, SDv1.5 (Rombach et al., 2022), Wukong (MindSpore).
GenImage has set of real images and a set of fake images for each category, to ensure uniformity, we report the accuracy. However, the real images always sourced from ImageNet, therefore, also report the AP with respect the corresponding real distribution. For accuracy,
common threshold of 0.5.
A.4.2. RESULTS
In Table 5 we report the accuracy (left) and AP (right). Based on the AP values, we can conclude that the methods which finetune the whole network represented by DRCT, Corvi, Rajan, along with our improved detectors perform better than the CLiP-based techniques represented by ClipDet and the original UFD methods. Furthermore, the AP in detecting VQDM generated images, improves for RajanO (Ours) by 4.5%. VQDM is latent diffusion model which has a
14

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Table Accuracy and AP of existing defectors on latent diffusiin images from GenImage benchmark. Accuracy is computed with a fixed threshold, while AP is computed with respect to the real distribution (ImageNet). Whole network maiiiig--bsse methods (DRCT, Corvi, Rajan, Corvie, Rajan@) outperform CLiP-based methods (UFD, ClipDer). On -QDM-generated images. Corvi (Ours) and RajanD (Ours) demonstrate improvements over their original counterparts. Additionally, on settings where Corvi, Rajan already perform well, our method performs the same if not slighty better.
ACCURACY (%)
MJ
SD1.4 SD1.5
WUKONG VQDM
AP AP(% (%)
MJ SDL.4
SDI.5
WUKoNG VQDM
UFD-PROGAN
68.17
78.60
78.60
81.05
81.34
UFD-PROGAN
74.46
89.19 88.91
93.03
95.52
UFD-LDM
56.24
63.75
63.56
71.05
85.43
UFD-LDM
74.61
86.56 86.19
91.34
96.65
COZZOLINO-LDM
67.91
85.32
85.71
78.40
82.70
COZZOLINO LDM
87.28
96.31
96.38
93.76
95.78
DRCT-CONVNENT
94.43
99.37
99.19
99.25
76.84
DRCT-CONYNENT
99.39
99.99
99.98
99.99
96.71
CORVI
99.67
99.99
99.89
99.97
80.86
CORVI
99.99 99.99 99.98
99.99
98.68
CORVIE (OURS)
99.31
99.76 99.63
99.73
98.97
CORVIE (OURS)
99.94 99.99 99.96
99.99
99.94
RAJAN
96.58
99.88
99.85
99.87
74.67
RAJAN
99.54 99.99
99.94
99.99
95.11
RAJANO (OURS)
98.68 99.83 99.79
99.79
90.02
RAJANO (OURS)
99.91 99.99 99.96
99.99
99.26
Table UFD Benchmark AP Scores across various diffusion models and defectors. Detectors trained with our improved algorithm (Corvie, RajanE) consistently outperform their base versions and other models across all UFD benchmark scttings, demonstrating superior generalization and robustness.
GLIDE
ADM
DALLE
LDM
AVG
МETHOD
100-27
100-10
50-27
100
200
200-CFG
CORVI
79.28
86.52
83.95
44.51
97.15
99.90
100.00
99.99
86.41
CORVIO (OURS)
88.61
91.17
89.24
74.52
99.50
100.00
100.00
99.99
92.88
RAJAN
71.51
77.57
77.54
44.63
89.19
99.90
100.00
99.99
82.54
RAJANG (OURS)
80.43
83.50
83.36
62.32
98.63
100.00
100.00
99.99
88.53
different architecture compared to LDM. This improvement further demonstrates the effect of ignoring real image artifacts. Furthermore, the accuracy measurements demonstrate that without calibrating the threshold, our detectors are able to detect latent diffusion generated images in the Genlmage benchmark.
A.5. Performance on the UED Benchmark
1. EXPERIMENTAL SETUP
In this section, we evaluate Corvi @ (Ours) and Rajan @ (Ours) on pixel-space diffusion models such as ADM (Dhariwal Nichol, 2021) and GLIDE (Nichol et al., 2022), as well as on autoregressive models such as DALL-B (Ramesh et al., 2021) and Stable Diffusion (Rombach et al., 2022). Since our focus is on comprehensive detection of images from known generator family, we do not consider GAN-generated images in this evaluation.
A.5.2. RESULTS
We report the results in Table 6. Both Corvig and Rajans demonstrate substantial improvements over their original counterparts in terms of AP on images generated by GLIDE, ADM, and DALL-E. These results indicate that, even when generalizing to entirely unseen settings, disregarding real-image features remains an effective strategy.
A.6. Spurious Correlations in the Real Distribution Could Influence Fake Features
In our work, we demonstrated that features associated with the real distribution harm the detectors performance, and proposed a way to mitigate such an issue by ignoring the real features under certain assumptions. However, our method relies on re-training the final layer of the neural network. We demonstrate way in which such a detector can still suffer from the effects of features associated with the real distribution. We rely on a toy example, hypothesizing such a case.
15

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
A. A TOY EXAMPLE
Let us consider the dataset used train the detector by Rajan al. (2025). The training data contains real images from COCO and LSUN. The LSUN images are WEBP compressed. The precise details can be found in Section 3. In the main paper, we demonstrate that the existing detector can associate the presence of WEBP compression artifacts with real images. However, we hypothesize that the detector can actually also associate the absence of WEBP compression artifacts with fake images.
To explain our intuition, we consider a simple feedforward neural network, with ReLU activations. This network has been trained using the dataset described above. We illustrate the network in Fig 12.
WEBP Artifact Sensitivity Neural networks, such as ResNet-50, exhibit sensitivity to WEBP compression artifacts, suggesting the presence of neuron that selectively activates in response to images containing such artifacts. Given a ReLU activation function, this neuron outputs a high activation magnitude for WE:BP-compressed images from the real distribution, particularly LSUN images, while producing a low or zero activation magnitude for images without WEBP compression, such COCO images and those from the fake distribution.
Flipping the Activation to Detect Absence of WEBP If this activation is multiplied by a negative weight, followed by the addition of an appropriate bias and the application of a ReLU activation, the network can learn a transformed version of this neuron that activates only when WEBP artifacts are absent. This means the network could, in principle, learn to detect images that have not undergone WEBP compression by repurposing the same underlying feature.
Combining WEBP and LDM Artifacts to Learn an AND Condition Beyond compression artifacts, the network also exhibits sensitivity to generative model artifacts, such as those present in latent diffusion model (LDM)-generated images. similar mechanism can be hypothesized for LDM artifacts, where neuron activates in response their presence. During training, for a fake image, both the absence of WEBP artifacts and the presence of LDM artifacts hold. If the network learns to associate this specific combination with the fake class, it effectively learns an AND condition-whers fake image is recognized only when WEBP artifacts are absent and LDM artifacts are present.
Impact Detector Robustness If the detector associates both the presence of LDM-artifacts AND) the absence of WEBP artifacts with fake images, applying WEBP compression to fake image during inference could contradict this learned AND condition. The addition of WEBP artifacts could weaken the distinguishing signal, reducing the activation of the fake-detecting neuron and thereby lowering the fake score. In fact, such a situation does arise in our experiments.
To illustrate this we revisit some of our previous experiments, in Fig. from Section 3.1, we show that excluding WEBP- compressed real images during training can yield strong detector performance, as seen in the method labeled Rajan (only COCO). This suggests that removing WEBP-related biases from the training data allows the model to generalize better, avoiding reliance on compression artifacts as shorteut for classification.
In Fig. 4, our method shows improvements over the baseline, demonstrating that explicitly mitigating spurious correlations can enhance detector performance. However, despite this improvement, the detector is still not as robust as Rajan (only COCO). This can be explained by our earlier toy example: if the model has learned an implicit rule where the absence of WEBP artifacts is a necessary condition for an image to be classified as fake, then introducing WEBP compression to fake images weakens the fake classification signal. Consequently, while removing WEBP comp-comp real images from training reduces bias, it does not fully eliminate the underlying vulnerability, since the model may still rely on other spurious correlations to distinguish real from fake.
A.7. Improved Detection of GAN-generated Images
Our work in the main paper focused on improving the detection of LDM (Rombach et al., 2022) generated images. In this section, extend the results to the detection of images generated by GANs (Goodfellow et al., 2014). We consider baseline ResNet-50 trained using the dataset created by Wang et al. (2020). This dataset consists of 360k real images taken from LSUN and 360k images generated by ProGAN (Karras et al., 2018). We use the same training recipe described in Appendix A. however, we do not employ the random resized crop data augmentation in this case. We train a ResNet-50 on this dataset. We refer to this baseline as Bas-line we re- re-train the last layer of this detector to ignore real features. We refer to this model as Baselaen (Ours).
16

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Table Accuracies of various defectors on CNN-generated images. most settings, our method GAN- B. outper- forms/maintains performance with respect to the original detector. Additionally, on most settings where GAN- CAN-Baseline already perform well, our method performs the same if not slightly better.
MIrrion
PROGAN
STYLIGIAN
STYLEGIAN2
GAUGAN
BIGIIN
CYCLaGAAN
STARGAN
DEUPPAKE
SAN
CRN
IMLE
WFCIR
AYG
UPD-PROGIAN
34.92
98.33
56.58
87.20
$2.20
UFD-LDM
98.18
90.75
94.62
70.35
CLEDDET
72.96
70:49
77.62
53.
$3.69
GAN DASELINE
100.00
99.52
93.34
95.33
96.65
93.14
99.34
53.43
14.33
99.96
99.87
100.00
90.61
CAN DASELINES)
100.00
99.82
98.96
94.52
95.02
93,30
99.77
68.17
75.57
86.75
86.75
99.70
91.53
Table 8. AP of various detectors on CNN-generated images. In most settings, our method GAN-BaselineO, outperforms/maintans
performance with respect the original detector. Additionally, most settings where GAN-Baxeling already perform well, our method performs the same if not slightly better.
MRTHOD
PROGAN
STYLEGAN
STYLEGAN2
GaUGAN
BIGGAN
CYCLEGAN
STARGAN
DREPPAKE
SAN
CRN
IMLE
WFCIR
UFD PROGAN
99.99
97.56
97.89
99.98
99.26
99.79
99.37
81.76
78.80
96.58
98.60
97.27
UFD-LDDM
99.68
91.36
99.78
98.04
99.83
97.51
70.52
90.40
CLIPDET
91.29
78.13
76.47
90.19
80.04
89.51
81.07
65,98
85.65
64.63
55.66
64,63
BAS-LISELINE
100.00
99,99
99,99
99.78
99.74
98.73
99.98
94.27
88.79
99.99
99.99
100.00
GAN-BASELINE@
100.00
99.99
99.99
99.30
99.03
98.93
99.99
95.45
94.46
99.99
99.99
99.99
A. IMPROVED ROBUSTNESS TO WEBP COMPRESSION
Our dataset uses real images from LSUN, Consequently, our baseline detector (GAN-Baseling also associates WEBP compression artifacts with the real distribution, similar to the observations recorded in Section 3.1. We conduct an experiment compare our retrained detector GAN-Baseline@ (Ours) with the original detector.
With this experiment, we intend to measure the sensitivity of the original GAN-Baseline to WEBP compression and measure if our method can mitigate these issues. We use the StyleGAN (Karras et al., 2019) test set provided by Wang et al. (2020). We sample 500 real images and 500 fake images randomly. We apply different levels of WEBP compression to the fake images and compute the AP, analogous to our measurement in Section 3.1.
Experiment Details:
Analysis: We present the results in Fig. 13. WEBP compression significantly degrades the performance of the baseline detector. In contrast, our detector demonstrates enhanced robustness to WEBP compression. This provides further evidence suggesting that avoiding reliance real features can improve robustness against such spurious correlations.
A.7.2. GENERAL PERFORMANCE
In this section, we study the generalization ability of the detector in comparison to other baseline detectors. We use the dataset consisting of CNN generated images from Wang et al. (2020). The dataset consists of ProGAN (Karras et al., 2018), StyleGAN (Karras et al., 2019), StyleGAN2 (Karras et al., 2020), GauGAN (Park et al., 2019), BigGAN (Brock et al., 2019), CycleGAN (Zhu al., 2017), StarGAN (Choi al., 2018) as well as Deepfakes (Rossler et al., 2019), super-resolution (SAN) (Dai et al., 2019) as well as networks which use a perceptual loss to refine images, such CRN (Chen & Koltun, 2017) and IMLE (Li et al., 2019). It also consists of high quality GAN-generated faces in WFIR (whi). This test set comes with both real and fake images for each generator category. Therefore, we report both accuracy with 0.5 threshold and the AP.
We report the accuracy and AP scores in Tables and 8, respectively. Consistent with our findings in Table 2, we observe that the full-network training paradigm represented by GAN-Baseline and GAN-Baseline @ (Ours) outperforms the CLIP- linear probing paradigm represented by the UFD methods and ClipDet. Our method, GAN-Baseline detector by 5.67 AP on images generated through super-resolution. Since super-resolution operates on real images, we hypothesize that the real features in these images harm the performance of the CAN-Baseline detector. However, our method is able to better detect such images since it does not rely on real features. Interestingly, our method shows lower accuracy on the CRN and IMLE test sets. Upon closer inspection, we find that the real distribution in these test sets consists of video game images from the GTA series, which differ significantly from the natural distribution. Notably, some patterns that the detector associates with fake images are also present in these video game images. To verify this, we conduct an experiment similar to the one in Section A.2. Except for the class "Test Real", all other classes use the same images as
outperforms the
17

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
described in Section A.2. We sample the "Test Real' distribution from the real images in the StyleGAN test We observe that most of the real images, except for the GTA images, exhibit similar logit scores. This shows that model still does good job in generalizing to different domains of real images, however, the performance some unrelated domains can drop.
18

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
Sensitivity Compression
Sersitivity
Corul
Corvi (Clvis)
Carvi
Corvi a (Curs)
Poei
Red
1909
3300 53m
3031
2350 12m
102
1350
545
ESS 53t em
3it 201 END
3300
Ragan
Raian [Curs)
Raian
Rajan D (Ours)
Look
Cemprestee Quality
230
Nose Deration)
5:00
320
1250
EX0
Level (Shundard
130
(a) JPEG Compression
(b) Additive Gaussian Noise
Sensitivity to Low-Pass Filtering
Logt Scote
Logit Scarr
0.1
Roke
Percentage of Frequer cies Retained (96)
Percentage of Frequencie Retained (16)
Rajan
Rajan (Ours)
Score
Logi Score
Reteined (16)
Prequencies Retained (1)
(c) Low-Pass Filtering
Figure Robustness Common Post-Processing Artifacts. We observe similar trends across various corruptions (JPEG compression, additive noise, and low-pass filtering) between the original detectors and our improved versions. Note that these perturbations were part of the training data augmentations. More importantly, the real image distribution exhibits very uniform logit scores, since our approach relies on the absence of generator artifacts to identify these images.
19

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
stable-diffusion-v1.. stable-diiffuiion-1..
stable-diifusion--2
midjourney-v5
stable-diftusion-x
Average Precision
Corvi a (Ours)
Corvi (Ours)
Corvi (0uns)
Cordi (Ours)
Corvi (Ours)
Scaling Factor
Scaling Factor
Scaling Factor
Scaling Factor
Scaling Factor
Figure Robustness Resizing (Synth We can observe that our detector, Corvie shows improved robustness downsizing
compared to the original Corvi
High activation presont and WEB compressionn is absert
Neuron fires if the contains arbitrary artifact
Input
Negative valued weight
activation image WEBP compressed, low otherulis
High activation image WEBP compressed
Figure 12. Spurious Fake Features. In this neural network, the circles demonstrate neurons, some neurons are bigger in size for demonstration purpose. For such case, the detector associate the absence of spurious real image artifact, such as WEBP compression with fake images.
AP Scores Across Models
1.0
Average Precision
0.9
0.7
GAN Baseline
0.5
GAN Baseline @ (Ours)
Compression Quality
Figure 13, Improved Robustness to WEBP compression (GAN case). Compared to the original GAN-Baseling our model displays an improved robustness WEBP compression.
20

---

Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection
GAN Baseline @
10
Logit
Redcaps
Test Real
GÍA
Cubism
Pop Art
Modem Art
Figure 14. Distribution of different kinds of real images. We observe that most types of real images are assigned similar value of fakeness. An exception GTA-basee images which has a relatively higher score indicating the presence spurious features.
21


Reviews:
[{"review_id": "x7FR8R6HMU", "reviewer": "Reviewer_ndGS", "summary": "This paper proposed an algorithm designed to constrain the focus of detectors  to generative artifacts while disregarding those associated with real data. This method will help  the model reduce susceptibility to spurious correlations and enhance robustness.\n## update after rebuttal\nThe authors have addressed some of my concerns, but I still have concerns about the quality of the paper, so I chose to give a weak rejection.\n\nFirst of all, what confuses me the most is that the authors compared with an important existing method UFD, but as we all know, UFD also proposed a very influential public dataset UniversalFakeDetect, which includes 19 test settings, but the authors did not conduct experiments on UniversalFakeDetect but only on a subset CNN-generated images.\n\nSecondly, Supplementary Material is Supplementary Material, and Appendix is Appendix. There is a special submission window for Supplementary Material, and authors can choose to provide their code, demonstration videos, or other materials. Of course, I read the Appendix provided by the authors, but this paper does NOT provide Supplementary Material.\n\nIn addition, the authors did not provide important ablation experiments at the beginning, and the newly added ablation experiment part cannot fully show the effectiveness and robustness of the proposed method.\n\nFinally, although these will not affect my final score, I hope the authors can further improve the quality of writing. There are only ten quotation marks in the whole paper, and the authors only needs to search to find at least two errors (misuse of quotation marks: ”real” (line 402) and typographical errors: While most regions of such images are“real” (line 368) ). It is best for the authors to read the paper completely from beginning to end.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**The authors' point that the distribution of real samples is harmful to detectors may need further discussion and verification. Prior works show the benefits of “positive samples”**\n\\\nWe would like to make some clarifications. We are unsure of the exact meaning of 'positive samples,' but we assume it refers to real images. Our paper does not suggest that using real images for training harms the detector. In fact, we also incorporate real images in our training process. The key finding of our work is that associating specific patterns with the real distribution can often be spurious, which undermines the detector’s reliability.\n\\\n\\\nWe provide concrete evidence for this claim. In Section 3.1, we show that the real distribution may contain unknown spurious correlations. Section 3.2 demonstrates that a detector trained to distinguish real images from LDM-generated ones can mistakenly associate certain features with real images. However, these same 'real' features appear in FLUX-generated images, proving the unreliability of 'real features' learned by discriminative models. Our results in Section 5 confirm this, as also noted by other reviewers (JDtd, GtjV, Qhvq).\n\\\n\\\nThe DIRE detector suggested by the reviewer supports our argument by associating JPEG compression with real images, leading to spurious correlations, as discussed in AEROBLADE (Ricker et al., 2024) Section 9. Similarly, Work [2] attempts to reduce intra-class variability in real images but remains susceptible to the same issue. As shown in Section 3.2, the features defining 'realness' relative to a generator are often spurious.\n\\\n\\\n**The benchmarks provided by this paper are partially missing. There are larger benchmarks than the one in this paper.**\\\nWe seek clarification on what the reviewer means by “partially missing.” We assume this refers to the claim of not testing our method on popular public benchmarks. However, we respectfully disagree. As detailed in Appendix A.3, we evaluate our model on GenImage, a widely used, modern benchmark for fake image detection. Our GAN-based detector is also tested on the established CNNDet benchmark (line 329, Appendix A.5.2). While our primary benchmark is the publicly available dataset from Rajan et al. (2024), chosen for its inclusion of images from recent generators, we have also tested our LDM-based detector on the Autoregressive/Diffusion Models from the UFD benchmark, as suggested by the reviewer, the results can be found in https://imgur.com/a/eLTN1Kv. Our results show that the stay-positive algorithm improves detector performance across various unseen generators, hopefully addressing the reviewer’s concerns.\\\n\\\n**The robustness tests in fake image detection also include the effects of JPEG compression and Gaussian noise. The authors should provide more robustness experimental tests.**\\\nPlease refer to the response to reviewer JDtd.\\\n\\\n**Include Ablations**\\\nWe assume the reviewer refers to ablating other design choices for stay-positive. To do so, we conducted two ablations: (i) clamping detector weights without re-training, and (ii) re-training the entire network while clamping only the last layer.\n\nResults: https://imgur.com/a/H8fuyIZ\n\nOur results (similar to Table 2) show that clamping without re-training leads to suboptimal performance due to improper reweighting of fake features. Training the entire backbone while clamping the final layer underperforms on FLUX images, likely due to newly learnt spurious fake features. We hope this clarifies the reviewer’s concerns.\n\n\n**The writing of this paper needs further improvement, for example, some quotation marks are incorrectly written**\\\nWe're happy to refine the writing but request the reviewer specify which parts need improvement. The example regarding incorrect quotation marks is unclear, could the reviewer point to the relevant line or section?\n\n**Supplementary Material:\nNone.**\\\nWe respectfully point out that this statement by the reviewer is incorrect. Our Appendix includes five sections that thoroughly discuss various details, and this has been acknowledged and confirmed by the other reviewers.\n\n**Please unify the format of references.**\\\nWe thank the reviewer for the suggestion and will unify the citation formats in the final version.\\\n\\\n**It would be better if the authors could show some visualization samples where the model fails to classify and analyze the reasons.**\\\nIn the Limitations section (Fig. 7), we show that our Corvi+ detector struggles with upsampled real images due to reliance on spurious features. Additionally, our models (Corvi+, Rajan+) fail to detect fake images from generators entirely different from the training distribution. Here are some qualitative examples:\n\nFirefly images (Detector trained on LDM images cannot detect these): https://imgur.com/a/GagThLg\n\\\nReal Images and Upsampled Versions (Corvi, Corvi+ can detect the original 512x512 ones but cannot detect the upscaled 1024x1024 ones): https://imgur.com/a/MHX3Py0", "claims_and_evidence": "The authors' point that the distribution of real samples is harmful to detectors may need further discussion and verification. Many papers such as DIRE [1] and  [2] clearly state the benefits of positive samples and even think about the problem of generated image detection from a perspective similar to anomaly detection.\n\n[1] Wang, Zhendong, et al. \"Dire for diffusion-generated image detection.\" Proceedings of the IEEE/CVF International Conference on Computer Vision. 2023.\n\n[2] Li, Jiaming, et al. \"Frequency-aware discriminative feature learning supervised by single-center loss for face forgery detection.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2021.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "Yes.", "experimental_designs_or_analyses": "The benchmarks provided by this paper are partially missing.", "relation_to_broader_scientific_literature": "This paper may provide a new perspective in the field of generated image detection.", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "Advantages:\n- The motivation of this paper is clear and the authors chose a straightforward but effective method to achieve the goal.\n- The charts related to the experiments in the paper are relatively clear, and the organization of the charts is logical.\n\nDisadvantages:\n- Some of the images in the paper are not clear. Please provide images in PDF format if possible.", "other_comments_or_suggestions": "None.", "questions_for_authors": "- There are many larger benchmarks in the field of fake image detection, for example in DIRE [1] and UFD [3] there are larger benchmarks than the one in this paper, but the authors did not conduct a complete test.\n\n[3] Ojha, Utkarsh, Yuheng Li, and Yong Jae Lee. \"Towards universal fake image detectors that generalize across generative models.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.\n\n- The robustness tests in fake image detection also include the effects of JPEG compression and Gaussian noise. The authors should provide more robustness experimental tests.\n- This paper does not provide ablation experiments to analyze the impact of different modules and parameters on the experimental results.\n- The writing of this paper needs further improvement, for example, some quotation marks are incorrectly written\n- Please unify the format of references. At least ensure that the citation formats of conferences and journals are consistent.\n- In the paper, the authors show many examples that perform better than other methods. It would be better if the authors could show some visualization samples where the model fails to classify and analyze the reasons.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Y9kTqL7Iz6", "reviewer": "Reviewer_JDtd", "summary": "This paper introduces \"Stay-Positive,\" an algorithm designed to improve AI-generated image detection by focusing solely on generative artifacts while disregarding features associated with real images. The authors argue that spurious correlations, such as compression artifacts that detectors mistakenly associate with real data distribution, significantly impact detection performance. Their key insight is that an image should be classified as fake if and only if it contains artifacts introduced by the generative model.\n\nThe proposed method involves retraining the last layer of existing detectors to constrain them to focus exclusively on generative artifacts. Through extensive experimentation, the authors demonstrate that Stay-Positive improves detector performance in several ways: (1) reducing susceptibility to spurious correlations, (2) enhancing generalization to newer generative models within the same family, and (3) increasing robustness to post-processing operations like compression and downsizing. Notably, the authors show substantial improvements on challenging generators like FLUX and aMUSEd compared to baseline methods.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**The paper could benefit from a more detailed analysis of potential limitations or failure cases of the proposed approach**\\\nIn this work, we have analyzed two limitations in detail, both related to the network's potential to learn spurious fake features. In Section 6, Fig 7, we show that our improved version of Corvi can still associate upsampling artifacts with the fake distribution. Additionally, in Appendix A.4, we explain a way in which the neural network (from stage-1 in Fig 3) could have learned to associate the absence of certain features with fake images, such as the lack of WEBP compression. We hope this clarifies the drawbacks of our work. We kindly request the reviewer to highlight any specific limitations that could be further explored, and we are happy to address them.\n\\\n\\\n**It would be beneficial to discuss the computational efficiency of the approach more explicitly, including additional training time and inference costs**\n\\\nWe thank the reviewer for raising these points. First, we would like to clarify that our method re-trains the final linear layer of the original network. Therefore, there are no additional inference costs, in comparison to the original method. We also compute the additional training time of our method (Rajan setting, only second stage), for which we use a batch size of 1024 on a single NVIDIA RTX A6000 machine. For optimal performance, we conduct stage-2 (Fig 3) re-training for 15 epochs which takes an additional 4h 8m 33s. Note that stage 1 takes 42h 5m 42s.\n\n\n**Personally, I think the overall idea of \"stay-positive\" not only benefit the generated images detection. It would be helpful to discuss how the method might be extended to other media types (audio, video) or multimodal content.**\\\nWe agree with the reviewer’s point. While the scope of our current work is focused on fake image detection, we believe the core principle of ignoring features associated with the real distribution will apply to other forms of media forensics, such as video and audio. We will address this in the final version of the paper.\n\n**The paper could be strengthened by exploring more diverse post-processing operations beyond compression and resizing, for example, random noise, etc.**\\\nWe thank the reviewer for raising this point, we have tested the sensitivity of our approach to JPEG Compression, additive gaussian noise and low-pass filtering based on the suggestions from various reviewers. We use the same experimental setting from Sec 3.1, where we take real images from reddit (Desai et al., 2021) and fake images from Stable Diffusion 1.5.\n\\\nLink: https://imgur.com/a/HtYRCvO\n\\\nWe notice that both our Corvi+ and our Rajan+ are very robust to post-processing operations. This shows that our detector can reliably detect fake images in the wild.", "claims_and_evidence": "The claims made in the paper are generally well-supported by empirical evidence. The authors provide comprehensive experimental results that demonstrate:\n\n- The effectiveness of Stay-Positive in improving detection performance across multiple generative models, with particularly significant gains for challenging models like FLUX (42.08 AP improvement) and aMUSEd (10.62 AP improvement).\n- Enhanced robustness to post-processing operations like compression and downsizing, which is demonstrated through controlled experiments and visualization.\n- The premise that focusing solely on fake image features rather than real image features yields better generalization.\n\nThese claims are supported by quantitative results presented in tables and figures, showing performance metrics (Average Precision) across different scenarios and comparing against established baselines. The experimental design includes appropriate controls and covers a wide range of generative models and post-processing techniques.", "methods_and_evaluation_criteria": "The proposed methods and evaluation criteria are appropriate for the problem at hand. The Stay-Positive algorithm involves retraining the last layer of existing detectors to focus exclusively on fake image features while ignoring real image features, which directly addresses the identified problem of spurious correlations.\n\nFor evaluation, the authors use a diverse comprising:\n\n- Real images from various sources (Redcaps, WikiArt, LAION-Aesthetics, whichfaceisreal)\n- Fake images generated by multiple models (SDv1.5, MidJourney, Kandinsky, FLUX, etc.)\n- Post-processed versions to simulate real-world conditions\n- Partially Inpainted Images\n\nThe evaluation metrics (Average Precision) are standard and appropriate for binary classification tasks. The authors test across a wide range of scenarios, including different generative models and various post-processing operations, which provides a comprehensive assessment of the method's effectiveness and generalization capabilities.", "theoretical_claims": "The paper does not present formal mathematical proofs for theoretical claims. Instead, it focuses on empirical validation of the proposed approach through extensive experimentation. The conceptual foundation—that detectors should only focus on fake artifacts and ignore real image features—is well-articulated and supported by the experimental results, but no formal proofs are provided.", "experimental_designs_or_analyses": "The experimental design appears sound and comprehensive. I examined the main experiments presented in the paper:\n\n- Comparison with baseline detectors (Corvi and Rajan) across multiple generative models, with and without post-processing\nRobustness tests against compression and downsizing\n- Performance on challenging newer models like FLUX and aMUSEd\n- The authors use appropriate controls, ensure diverse test datasets, and report standard metrics. The experiments effectively isolate the contribution of the Stay-Positive approach by comparing it with strong baselines using the same underlying architectures.\n\nOne particularly convincing aspect is the demonstration of improved performance on generative models not seen during training, which supports the claim about better generalization capabilities.", "relation_to_broader_scientific_literature": "This work builds upon and extends previous research in fake image detection:\n\n- It addresses limitations identified in recent works by Corvi et al. (2023) and Rajan et al. (2024), particularly regarding robustness to post-processing and generalization to new models.\n- It connects to the broader literature on spurious correlations in machine learning models, applying these concepts specifically to the fake image detection domain.\n- The paper relates to work on detecting images from diffusion models, flow-based models, and other generative architectures, extending detection capabilities to newer models like FLUX and aMUSEd.", "essential_references_not_discussed": "I think the references in the manuscript are relatively comprehensive.", "other_strengths_and_weaknesses": "Strengths:\n- The proposed approach is conceptually simple yet effective, making it easy to implement on top of existing detectors\n- The extensive evaluation across multiple generative models and post-processing techniques demonstrates the method's practical utility\n- The focus on reducing spurious correlations represents a meaningful contribution to improving detector robustness\n\nWeaknesses:\n- The paper could benefit from a more detailed analysis of potential limitations or failure cases of the proposed approach\n- There is limited discussion about the computational overhead or additional training time required for implementing Stay-Positive compared to traditional approaches", "other_comments_or_suggestions": "Personally, I think the overall idea of \"stay-positive\" not only benefit the generated images detection. It would be helpful to discuss how the method might be extended to other media types (audio, video) or multimodal content.\n\n- Consider including a more detailed analysis of cases where Stay-Positive underperforms or fails, which could provide insights for future improvements\n- It would be beneficial to discuss the computational efficiency of the approach more explicitly, including additional training time and inference costs\n- The paper could be strengthened by exploring more diverse post-processing operations beyond compression and resizing, for example, random noise, etc.", "questions_for_authors": "See \"Other comments\" part", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethics_expertise_needed": ["Other expertise"]}}, {"review_id": "Xon7jPuHru", "reviewer": "Reviewer_GtjV", "summary": "This paper presents a method for improving fake image detection. It makes the observation that a fake image detector may learn spurious features associated with real images, such as post processing artifacts or image quality, which may lead to suboptimal detection performance. It thus proposes to constrain the detector to focus solely on artifacts that characterize fake images. Specifically, it focuses on the setting where the last layer of the fake image detector is a linear layer, where positive weights contribute to the likelihood of classifying as fake and negative weights reduce this likelihood. It proposes retraining this layer so that only positive weights contribute to the final prediction. Experiments show that this approach improves the robustness and consistency of fake image detectors.\n\n## update after rebuttal\n\nI am satisfied with the authors' rebuttal and keep my original score of 3.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**In Figure 7, it appears that the Redcaps images have much higher fakeness probabilities under the Corvi with the proposed method model than under the regular Corvi model. Could the authors provide more discussion about this phenomenon?**\n\nWe thank the reviewer for raising this point. In all our experiments (Sections 5.2, 5.3, and 5.4), we observe that Corvi+ performs better in detecting fake images, despite the apparent \"higher probability of fakeness for real images\" (further details in Appendix A.2). This issue arises from our use of the term \"probability of fakeness,\" which we now recognize as a misleading interpretation.\n\nOur approach removes negative weights in the final layer, meaning it does not rely on \"real features.\" As a result, the real score (Section 3.2, lines 156–159) is always zero, preventing our method from assigning highly negative scores for a given image. Consequently, for real images, the sigmoid output is closer to 0.5 rather than 0. This does not imply that a real image is half as likely to be fake, but rather represents a logit score that helps separate real and fake distributions. We will provide additional clarification for this in our final report.\n\nBoth Corvi and Corvi+ learn the same spurious fake features, such as upsampling artifacts. However, because Corvi+ eliminates spurious correlations associated with the real distribution while retaining those linked to the fake distribution, it ultimately has fewer spurious correlations overall. This leads to better detection performance.\n\n**Related to the question above, since the proposed method retrains the last layer to focus on fake attributes, would it be a concern that spurious correlations associated with fake images might inadvertently be amplified through this process?**\n\nThere is a possibility that spurious correlations associated with the fake distribution could be inadvertently amplified. However, the core goal of our work is to highlight that patterns associated with the real distribution are spurious and should not influence the decision. Ignoring these patterns improves the detector's performance, independent of the spurious features in the fake distribution.\n\n**Additionally, are there any insights or analyses of what specific types of real or fake features are learned by the detectors, e.g. by inspecting the weights, using saliency maps, or other interpretability methods, etc.?**\n\nWe have identified and explained specific artifacts linked to each distribution. In Section 3, we show that compression artifacts can be associated with real images, and low-level artifacts may be spuriously linked to the real distribution due to quality differences in the training data (Section 3.2). Further evidence is provided in Section 5.3.2 (lines 372–384), where post-processing FLUX- and aMUSEd-generated images significantly improves the performance of the original Corvi detector (from 57.25 to 74.57 on FLUX) and Rajan detector (from 80.64 to 87.80 on FLUX), suggesting that post-processing removes spurious low-level features which the detector associates with the real distribution.\n\nWe also experimented with GradCAM [1], but the activation maps did not provide clear insights, so we did not discuss them in our work.\n\n**Minor Suggestions**\n\nWe thank the reviewer for providing us with these minor suggestions, we will incorporate these changes in the final version.\n\n**References**\n1. Selvaraju, Ramprasaath R., et al. \"Grad-cam: Visual explanations from deep networks via gradient-based localization.\" Proceedings of the IEEE international conference on computer vision. 2017.", "claims_and_evidence": "The claims made in the paper are generally backed up by experimental analyses and/or citations of findings from existing works.", "methods_and_evaluation_criteria": "[Method] \n\nStrengths: \n\n* The proposed method looks reasonable. Conceptually, it does address the motivation of preventing the spurious correlation associated with real images.\n\n* It is lightweight and is compatible with other existing methods of learning fake images detectors.\n\nConcerns:\n\n* In Figure 7, it appears that the Redcaps images have much higher fakeness probabilities under the Corvi with the proposed method model than under the regular Corvi model, even at scaling factor 1. As scaling factor increases, the fakeness probability under Corvi+proposed method further increases -- e.g. under scaling factor 1.6, a Redcaps image on average gets fakeness probability above 0.5 under Corvi+proposed method, but only receives fakeness probability at around 0.1 on average under regular Corvi. Could the authors provide more discussion about this phenomenon?\n\n* Related to the question above, since the proposed method retrains the last layer to focus on fake attributes, would it be a concern that spurious correlations associated with fake images might inadvertently be amplified through this process?\n\n[Evaluation Criteria] The selection of benchmark datasets is reasonable and covers diverse real-world scenarios. The evaluation metrics are appropriate for this task.", "theoretical_claims": "N/A. This work does not involve theoretical claims or proofs.", "experimental_designs_or_analyses": "The experimental designs and analyses are reasonable. \n\n* The settings consider comprehensive scenarios, where the real images cover different domains and styles, and the fake images are sourced from various recent, widely used diffusion models and GAN models, with both full and partial (i.e. inpainting) generations. This covers realistic scenarios in practical applications and demonstrate generalizability of the proposed method. Results verify that the proposed method attains consistent performance improvements across these different conditions.\n\n* Analyses are provided to support the claims that existing fake image detectors learn spurious correlations of real images, such as compression and downsizing, and show that the proposed method successfully mitigates the problem.", "relation_to_broader_scientific_literature": "This paper falls under the broader fields of data forensics and fake image detection. The paper is motivated by the observation that detectors trained with existing methods may inadvertently learn spurious correlations and the proposed method alleviates this problem and can be applied on top of various recent existing works.", "essential_references_not_discussed": "The paper sufficiently covers relevant literature in the field.", "other_strengths_and_weaknesses": "Please refer to other sections.", "other_comments_or_suggestions": "[Minor Suggestions on Writing/Presentation] \n\n* The second and third paragraphs of the introduction seem a bit repetitive and read like paraphrased versions of each other. They could be condensed into one.\n\n* It could be helpful to add an “Average” column in the tables to make it easier to compare overall performance and consistency across different fake image sources among the baselines as well as the proposed method.\n\n* Typo in Limitations - L415 should be \"associates upsampled images with the *fake* distribution\"?", "questions_for_authors": "* See the questions under Methods And Evaluation Criteria.\n\n* Additionally, are there any insights or analyses of what specific types of real or fake features are learned by the detectors, e.g. by inspecting the weights, using saliency maps, or other interpretability methods, etc.?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "cBRPaNCjmJ", "reviewer": "Reviewer_Qhvq", "summary": "The paper addresses AI-generated image detection challenges, showing that detectors rely on spurious real-image artifacts. It introduces Stay-Positive, which retrains the last layer to focus only on fake features by enforcing non-negative weights.\nKey contributions:\n1.   \tIdentifies spurious correlations (e.g., WEBP compression) that mislead detectors.\n2.   \tStay-Positive algorithm improves generalization by removing reliance on real-image artifacts.\n3.   \tEnhances robustness to post-processing, resizing, and newer models (FLUX, aMUSEd).\n4.   \tImproves detection of partially AI-modified images, aiding forensic applications.\nThe findings suggest ignoring real-image features improves fake detection and reduces misclassification risks.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Further test the hypothesis from Case Study 2 by applying additional post-processing techniques and evaluating more generative models. This will strengthen the analysis derived from distribution plots, as the observed differences could also be attributed to a generalization gap**\n\n**Test on other generators**: We would like to clarify that the generalization gap could manifest in two ways. First, the learned patterns associated with fake images may be absent in FLUX images. Second, while some signs of fakeness may be present in FLUX images, the decision may be influenced by spurious signs of realness. We believe the latter issue should be avoided, which our work demonstrates.\n\nThe principle that relying on real features harms the detector holds true for generators beyond FLUX. We have evaluated our approach on aMUSEd (Tables 1, 2) and observed the same issue. This effect is also evident in VQDM (Table 4) and generators like DALL-E, GLIDE and ADM[1] (https://imgur.com/a/eLTN1Kv), reinforcing our claim that this is a broader limitation of existing methods, which our approach mitigates.\n\n**Post-Processing**:  We have tested our detector's sensitivity to JPEG compression, additive noise, and low-pass filtering. For the results please refer to the response to reviewer JDtd. However, we would like to note that PNG is a lossless compression format and does not introduce artifacts.\n\nWe hope that this serves as evidence regarding the general nature of this limitation.\n\n**However, this technique introduces a bias toward the fake distribution, potentially limiting the model’s ability to generalize across different generators.**\n\nIf an image lacks signs of fakeness, our method will not classify it as fake, which we do not consider a limitation. Given training images from a specific generator, we can only learn how that generator deviates from the real distribution. Without detectable artifacts, there is insufficient evidence to classify an image as fake. Our work is the first to show that when generalizing to images from a known family of generators (Introduction, lines 12–28), existing detectors underperform because they rely on real features.\n\nWithout signs of “fakeness”, existing detectors may attempt to classify images as real based on learned patterns, but as shown in Sections 3 and 5.4, these features are mostly spurious, making the classification hypothesis unreliable despite potential success in some cases.\n\nAppendix A.2 shows that our detectors, Corvi+ and Rajan+, trained on COCO and LSUN real/fake images, perform similarly on real images from other domains, like GTA and artworks, despite these domains being unseen during training. This confirms that our method detects fakeness patterns, not just labeling out-of-distribution images as fake, reinforcing our core claim.\n\n**Spurious Fake Features Remain**\n\nIt is true that spurious fake features can remain even after our method. However, we would like to clarify that the purpose of the study is to show that the real features learned by the neural network are spurious which end up harming the detector when it comes to generalization.\n\n**Use existing benchmarks for resizing studies**\n\nWe thank the reviewer for sharing the Synthbuster benchmark for the resizing study. We have tested our approach on this benchmark, using a plot similar to Fig 8 from the Synthbuster paper. \n\nResults Link: https://imgur.com/a/SMYKgea\n\nThe results show that our method effectively mitigates Corvi's spurious association of downsampling with realness, providing evidence of the generality of our algorithm.\n\n**Compare the proposed method with more zero-shot techniques to provide a broader evaluation.**\n\nWe compare our detector with large model-based detectors like UFD and ClipDet, and observe that these methods do not perform as well as fully-trained neural networks, as shown in Table 2. We also tested the latent diffusion specific zero-shot detector AEROBLADE (Ricker et al., 2024), which fails to match the performance of our detectors. Therefore, we do not believe leveraging pre-trained techniques offers advantages over our approach.\n| AP  | SD     | MJ     | KD | PG | PixArt | LCM     | Flux    | Wuerstchen | aMUSEd  |\n|--------------------|--------|--------|-----------|------------|----------|---------|---------|------------|---------|\n| AEROBLADE | 90.81 | 96.48 | 94.03 | 71.53| 87.84|60.34| 88.39| 85.93| 88.39|\n| Corvi + (Ours)|98.94 | 94.92 | 97.71| 97.87| 98.59 | 98.74| **94.23**| **98.16**| 95.47|\n| Rajan + (Ours)| **99.23** | **96.98** | **98.22**| **98.53** | **99.11**| **99.57**| 91.85 | 94.74| **97.26** |\n\n**References not discussed**\n\nWe would like to highlight the fact that we have discussed zero-shot methods (Related Work, line 417-428). However, we will also cite works such as ZeroFake in our final version.\n\n**References**\n\n[1] Dhariwal, P., & Nichol, A. (2021). Diffusion models beat gans on image synthesis. NeurIPS 21", "claims_and_evidence": "The paper provides strong empirical support for its main claims. It evaluates multiple generative models (LDM, FLUX, aMUSEd, GANs) and tests post-processing artifacts, resizing, and inpainting, making the results robust.\nWell-Supported Claims:\n·       Spurious Correlations in Detection: The study shows real-image artifacts (e.g., WEBP compression, downsizing) cause misclassification, supported by fake and real score distributions.\n·       Stay-Positive Improves Robustness: The method re-trains only the last layer with non-negative weights, preventing reliance on real-image features. Tables 1 and 2 confirm its effectiveness.\nClaims Needing More Support:\n·       Post-Processing Artifacts: The study focuses mainly on WEBP compression. Testing JPEG, PNG, and frequency-based artifacts is needed to rule out dataset bias.\n·       FLUX Misclassification due to real features: FLUX is out-of-distribution for the model. Testing diverse generative models (e.g., DALL·E, Imagen) would clarify if this is a broader limitation.", "methods_and_evaluation_criteria": "Yes, the model is trained on LSUN, COCO, Redcaps and evaluated on LDM, FLUX, aMUSEd, GANs. Which includes up-to-date models and comparison datasets. The Stay-Positive modification correctly re-trains only the final layer, enforcing non-negative weights by setting all negative values (which pushes prediction to zero, i.e. real) to zero.\nThis ensures detection relies only on fake features, improving robustness to post-processing (compression, resizing, inpainting).", "theoretical_claims": "The argument for using non-negative weights in the final layer appears well-founded within the framework of their proposed method. It effectively forces the model to focus exclusively on fake image features, thereby reducing reliance on spurious correlations from real data. Logically, this makes sense because a feature that contributes positively to the detection of fakeness is assigned a label of 1.\nHowever, this technique introduces a bias toward the fake distribution, potentially limiting the model’s ability to generalize across different generators.\n\nSpurious Fake Features Remain: While the method removes real-image-related biases, it does not necessarily address spurious correlations within fake features. The paper itself acknowledges this:\n\"Our approach ensures that the detector ignores real image-specific features, but these features can still shape its notion of fakeness.\"", "experimental_designs_or_analyses": "Yes, I reviewed the experimental setups and analyses.\n Below are the key experiments and their validity:\n1.   \tCase Study 1: Post-Processing Artifacts\na.       Post-Processing Artifacts: The experiment confirms that WEBP compression causes misclassification due to spurious correlations. The results are valid.\nb.       Issue: The study only tests WEBP; broader validation with JPEG, PNG, and other artifacts is needed.\nc.      The resizing-based artifact analysis only uses images generated by SDv2.1, despite an existing benchmark dataset for this type of evaluation. the study should leverage an existing benchmark – for example, https://github.com/grip-unina/ClipBased-SyntheticImageDetection/tree/main\n\n\n2.       Case Study 2: Generalization Across Generators\na.      The experiment examines how Corvi-trained detectors struggle with FLUX-generated images, suggesting reliance on spurious real-image features.\nb.       The analysis is well-supported by fake and real score distributions, which show FLUX images receive higher real scores than LDM ones.\nc.       Issue: FLUX images are out-of-distribution for the model. More tests on other out-of-distribution generators (e.g., Imagen, DALL·E) could indicate whether this is a generalizable limitation.\n3.       Stay-Positive Algorithm Validation\na.       Results confirm that the method reduces misclassification caused by spurious correlations, improving detection on post-processed and partially inpainted images.", "relation_to_broader_scientific_literature": "Unlike prior methods that focus on both real and fake features, this paper argues that fake image detection should be based exclusively on generative artifacts, disregarding any patterns related to real images, using a very simple method of second-stage training.\n2.       Experiments show significant performance gains in detecting FLUX and aMUSEd-generated images, which were previously misclassified due to reliance on real-image artifacts.\n3.       Prior detection methods fail to identify partially AI-modified images due to their reliance on real-image features.", "essential_references_not_discussed": "The paper compares Stay-Positive to state-of-the-art zero-shot approaches like CLIP-based detectors (CLIPDet) and universal fake image detectors (UFD).\n·       Findings: While CLIP-based zero-shot detectors perform well on seen distributions, they struggle with new diffusion models (e.g., FLUX, aMUSEd), whereas Stay-Positive improves generalization.\n \nThere are not many cities of formal statistical tests, and zero-shots works such as:\n·       Manifold induced biases for zero-shot and few-shot detection of generated image.\n·       ZeroFake: Zero-Shot Detection of Fake Images Generated and Edited by Text-to-Image Generation Model\nWhich aligns with the idea of focusing on fake features generated by LDMs.", "other_strengths_and_weaknesses": "Strengths:\nThe paper introduces a simple yet effective idea: classifying fake samples primarily based on fake features rather than relying on the real data distribution. This approach has several advantages:\na.       The second-stage fine-tuning is relatively fast to perform.\nb.       It focuses on specific features and artifacts generated by different image generators.\nc.       The method is practical and applicable to real-world scenarios.\nd.       The empirical diagnostics are well-structured, intuitive, and logically sound.\ne.      Robustness to inpainting detection.\nWeaknesses:\nThe approach is supervised and trained on relatively small datasets, especially compared to zero-shot methods that leverage large-scale, pre-trained predictors.\n\n\nIgnoring certain real-image features may lead to misclassification in cases where \"fakeness\" is absent in generated samples. This poses a generalization limitation, particularly when detecting more advanced or unseen generative models. Moreover, this approach may introduce a strong bias toward the fake distribution, potentially compromising the model's generalization.", "other_comments_or_suggestions": "Compare the proposed method with more zero-shot techniques to provide a broader evaluation.\n2.      Further test the hypothesis from Case Study 2 by applying additional post-processing techniques and evaluating more generative models. This will strengthen the analysis derived from distribution plots, as the observed differences could also be attributed to a generalization gap.\n3.      Some experiments were conducted on very small datasets, such as Section 5.1.2 (Resizing-based artifacts), which may impact the reliability of the findings.\n4.      Certain tests utilized custom-generated images from Stable Diffusion 2.1 rather than pre-existing benchmark datasets (e.g., in Section 5.1.2). For instance, WhichFaceIsReal has a benchmark dataset based on COCO, and other open-source datasets are available as well. Using standardized datasets would improve reproducibility and comparability.", "questions_for_authors": "--", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: 1x weak reject, 3x weak accept. This paper introduces an algorithm that constrains fake image detectors to focus exclusively on generative artifacts while ignoring real-image features, aiming to reduce spurious correlations and enhance robustness. The reviewers agree on the (1) clear motivation and simplicity of the proposed method, (2) comprehensive experimental evaluations and ablations that support improved robustness and generalization, and (3) effective empirical demonstrations across multiple generative models and post-processing scenarios. They also note (1) incomplete coverage of larger benchmarks and certain robustness tests (e.g., on UniversalFakeDetect, JPEG compression, and Gaussian noise), (2) some issues with writing clarity and image quality in the presentation, and (3) the potential amplification of spurious fake features due to retraining the last layer. The authors’ follow-up responses have convincingly addressed many of these concerns through additional experiments, clarifications, and expanded evaluations, so the AC leans to accept this submission.
Decision: Accept (poster)