PiD: Generalized AI-Generated Images Detection with Pixelwise Decomposition Residuals
Authors: Xinghe Fu
Zhiyuan Yan
Zheng Yang
Taiping Yao
Yandan Zhao
Shouhong Ding
Xi Li
Venue: ICML 2025 poster (2025)
Keywords: AIGC detection
Generative models
Deepfakes
Deep learning
Image representation
Low-level vision
Primary area: applications->computer_vision
TL;DR: A generalizable AI-generated image detection method with pixelwise decomposition residuals is proposed.

Abstract: Fake images, created by recently advanced generative models, have become increasingly indistinguishable from real ones, making their detection crucial, urgent, and challenging. This paper introduces PiD (Pixelwise Decomposition Residuals), a novel detection method that focuses on residual signals within images. Generative models are designed to optimize high-level semantic content (principal components), often overlooking low-level signals (residual components). PiD leverages this observation by disentangling residual components from images, encouraging the model to uncover more underlying and general forgery clues independent of semantic content. Compared to prior approaches that rely on reconstruction techniques or high-frequency information, PiD is computationally efficient and does not rely on any generative models for reconstruction. Specifically, PiD operates at the pixel level, mapping the pixel vector to another color space (e.g., YUV) and then quantizing the vector. The pixel vector is mapped back to the RGB space and the quantization loss is taken as the residual for AIGC detection. Our experiment results are striking and highly surprising: PiD achieves 98% accuracy on the widely used GenImage benchmark, highlighting the effectiveness and generalization performance.

PiD: Generalized AI-Generated Images Detection with Pixelwise Decomposition Residuals
Xinghe Fu'
Zhiyuan 2 Zheng Yang'
Taiping Yao?
Yandan Zhao? Shouhong Ding² Xi
Abstract
Vedhoda
MIY (CVP9224)
DACT VCNL
SDv1.5
Fake images, created by recently advanced gener- ative models, have become increasingly indistin- guishable from real ones, making their detection crucial, urgent, and challenging. This paper intro- duces PiD (Pixelwise Decomposition Residuals), novel detection method that focuses on resid- ual signals within images. Generative models are designed to optimize high-level semantic content (principal components), often overlooking low- level signals (residual components). PiD lever- ages this observation by disentangling residual components from images, encouraging the model to uncover more underlying and general forgery clues independent of semantic content. Compared to prior approaches that rely on reconstruction techniques or high-frequency information, PiD computationally efficient and does not rely on any generative models for reconstruction. Specifically, PiD operates at the pixel level, mapping the pixel vector another color space (e.g.. YUV) and then quantizing the vector. The pixel vector is mapped back to the RGB space and the quantization loss is taken as the residual for AIGC detection. Our experiment results are striking and highly surpris- ing: PiD achieves 98% accuracy on the widely used GenImage benchmark, highlighting the ef- fectiveness and generalization performance.
30v2.4
203
Guid
Midoumey
Wukenp
BUAAN
Figure 1. Cross- gooss-gnnerators detection performance the Gen- Image benchmark (Zhu et al.. 2024) using the Accuracy metric. We compare our method (PiD) with existing SOTA detectors and demonstrate surprisingly superior results in generalization (98% Accuracy on average).
difficult to distinguish from real (Rombach et al., 2022; Zhan et al., 2023; Yan al., 2025). Although these ad- vanced technologies have opened up new possibilities in industries, they have also raised significant security con- cerns about the spread of disinformation. Al-generated fake images can be misused to misguide public opinion, fabri- cate evidence in forensic science, undermine trust in digital media, and more. Therefore, detecting such Al-generated images (AIGIs) has become critical and urgent topic in both academia and industry.
1. Introduction
The rapid advancement of generative models, such Gener- ative Adversarial Networks (GANs) and Diffusson Models, has revolutionized the field of image synthesis, enabling the creation of photorealistic images that are increasingly
One particularly effective detection strategy is using recon- struction. Reconstruction-bant methods like DIRE (Wang et al., 2023), LARE (Luo et al., 2024), and DRCT (Chen et al., 2024) have proven generalization performance for detecting Al Al-generated images by leveraging discrepancies between originals and their reconstructions. However, these approaches typically rely on heavy self-reconstruction gen- erators (e.g., DDIM in DIRE) to simulate how a genera- tive model might rebuild an image, capitalizing on the idea that real images often fail to preserve low-level details dur- ing reconstruction. Their high computational cost also
'College of Computer Science and Technology, Zhejiang Uni- versity, Hangzhou, China 'Youtu Lab, Tencent, Shanghai, China. Correspondence to: <xilizju@@pp edu.cn>> Taiping Yao <taipingyao@tennt tencent.com
Proceedings of the ndnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

PiD: Generalized AI-Generated Images Detection with Pixelwise Decomposition Residuals
prohibitive for weal-world applications, and more critically, detectors trained on these frameworks, with specific self- reconstruction generators involved, potentially being over- fitted to generator-specífic artifacts, resulting in poor generalization in previously unseen generators (Ojha et al., 2023; Yan et al., 2023). For instance, Liffusion-based self- construction generators are used in DIRE and DRCT, which struggle to generalize to GAN- -en-geaeet images, as they learn patterns tied to diffusion priors rather than universal and general detection cues.
We propose a computationally efficient, generator-fre, yet highly effective method based on pixelwise decom- position residuals, achieving superior generalization performance on widely used benchmarks.
We propose a new perspective to decompose the resid- ual signal: we first operate at the pixel level and map the pixel vectors to color space, and then quantize the vector to produce the residual signals.
We conduct extensive experiments on existing widely used benchmarks and demonstrate the surprisingly high generalization performance over other SOTAs.
With the rapid development of vision- lanounle models, re- cent works have explored them for detection by leverag- ing the pre-trained semantic knowledge within the vision- language models. CLIP (Radford et al., 2021), used in Uni- vFD (Ojha et al., 2023) and C2P-CLIP (Tan et al., 2024b), is used to identify inconsistencies in multimodal embeddings or perform linear classification based on semantic features. A more recent work, FatFormer (Liu et al., 2024), proposes a lightweight adapter and injects frequency information into the original CLIP model, enhancing its generalization perfor- mance. While promising, such methods risk obsolescence as generative models increasingly prioritize photorealism and semantic coherence. This underscores the enduring importance of low-level traces for robust detection.
2. Related Work
In this section, we briefly introduce the existing literature in the field of AIGI detection. Following Tan et al. (2024b); Yan et al. (2024c), we systematically categorize the field into two principal domains: Face Forgery Detection and AIGC Detection for discussion.
2.1. Face Forgery Detection
Face forgery (classical deepfake) detection has been a promi- nent area of research due to the quick rise of face-swapping and face-reenactment. The domain of face forgery detection has seen substantial advancements, with numerous studies concentrating on the exploitation of spatial or frequency information derived from images. Face forgery detection methods can be broadly categorized into high-level and low- level approaches. High-level methods focus on biological or behavioral inconsistencies, such as irregular eye-blinking patterns (Li et al., 2018) or lip-sync artifacts (Haliassos et al., 2021), to exploit unnatural facial dynamics in deepfakes. In contrast, most works target low-level cues, including spatial artifacts (e.g., using Xception (Chollet, 2017) detect tex- ture anomalies (Rossler et al., 2019b)) or frequency artifacts (Luo et al., 2021; Qian et al., 2020; Masi et al., 2020; Woo et al., 2022) caused by forgery generation processes. To enhance generalization, recent strategies diversify training data via adversarial perturbations (Chen et al., 2022), chal- lenging fake data synthesis (Li al., 2020; Shiohara et al., 2022; Cheng al., 2024), or disentanglemennt-baane sentation learning (UCF (Yan et al., 2023) and UDD (Fu et al., 2025)), or latent space simulations (LSDA (Yan et al., 2024a)) to capture invariant forgery features across manipu- lation techniques.
Given the above concerns, the research question becomes: how can we find a computationally simple, and at the same time, universal forgery artifact, without relying on snteratoo--pecffte cues?
To address this, in this paper, we propose a novel detection method, PiD (Pixelwise Decomposition residuals), which focuses on pixel-level residual signals within images. Un- like high-level semantic features, which are prioritized by generative models, residual components are typically over- looked during the image synthesis process. These residual signals, which include subtle pixel-level inconsistencies and quantization artifacts, provide a rich source of forgery clues that are independent of the semantic content of the image. By disentangling and analyzing these residual components, PiD can uncover underlying and general generative patterns that are difficult to discover from the original RGB image.
Specifically, our PiD operates at the pixel level, mapping pixel vectors to alternative linear transforms (c.g.. YUV) and then quantizing them. The quantized vector is then mapped back to the RGB color space with the inverse trans- form. After that, the quantization loss, which represents the residual signal, is used as key feature for AIGC detection. This approach is computationally efficient, as it avoids the need for complex reconstruction techniques or reliance on generative models. The superior generalization performance of the proposed method is shown in Fig.
repre-
2.2. AIGC Detection
The rapid evolution of generative technologies has expanded synthetic content beyond facial forgeries to diverse scenes, driving research toward AIGC detection: a task more com- plex than traditional face forgery detection due to its broader
The key contributions of this work are three-fold:
2

---

PiD: Generalized AI-Generated Images Detection with Pixelwise Decomposition Residuals
Pixelwise Transform Mr
Inversion Transform M
0,299
1.402 -0.756336
168736
-0.341366
0.418688
1.0
1.972
0.0
After CVT Transform
Quantizing in the color space
Quant.
63.668
63:783
63
62
61
56.135
$7.195
69.897
56
57
59
Real or Synthesized
NN
Input
Residual Signal
Figure 2. The pipeline of the proposed PiD method. A pixelwise transformation matrix M, is applied the input RGB image, and quantization operation is appended to the projected color space. The quantized image is then mapped back to the RGB space with M, The residual information is decomposed by subtracting the quantized image from the original image. The residual signal is sent to the detection network like ResNet (He et al., 2016) to distinguish real and synthetic images.
forgery types and heightened demands for generalization. Current methodologies address this challenge through two complementary lenses: low-level artifact analysis and high-level semantic cues. Low-level approaches target subtle statistical irregularities induced during content gen- eration: CNN-Spot (Wang et al., 2020) employs data aug- mentation improve generalization, while BiHPF (Jeong et al., 2022) amplifies artifacts via dual high-pass filters, LGrad (Tan et al., 2023a) extracts gradient-based patterns, NPR (Tan et al., 2024d) models neighboring pixel relation- ships, and random-man mapping features (Tan et al., 2024a) expose forgery-speciffi distortions. High-level methods, conversely, leverage semantic inconsistencies in synthetic content: UnivFD (Ojha al., 2023) adopts CLIP embed- dings for zero-shot detection, FatFormer (Liu et al., 2024) in- tegrates frequency analysis with vision-language alignment from CLIP, and LASTED (Wu et al., 2023) exploits text- guided contrastive learning to identify mismatches between visual and textual semantics. By synergizing low-level ar- tifact detection with high-level semantic reasoning, these strategies collectively fortify defenses against the growing sophistication of AIGC threats.
loss as follows:
1 N Lcs N Σ log + (1-9:) yz) log(1 pc)l, (1)
where y/ E 10, is the ground-truth label, and N is the batch size. However, directly taking the original image x as input in AIGI detection is usually challenging due to the high quality of synthesized images. requires a powerful pre-trained network as the detector achieve high detection accuracy. As an alternative, it is crucial to find an image representation that is difficult for the current generative models to fit.
Modern generative models (c.g., diffusson models (Ho et al., 2020)) optimize the mean squared error (MSE) during train- ing:
LMSE Bl((< G(r e))
(2)
where G(-) is the generator and denotes noise. The MSE loss decomposes into:
LMSE
(E(G(,, E[x])
Bins?
3. Method
+ VarlG(a, c)] + [E[ - E[x])²]
(3)
Variance
Noise
3.1. Problem Setup
Critically, the noise term corresponds to data- data-specific arti- facts that remain irreducible even for high-fidelity synthetic images. To exploit this in AIGI detection, general ap- proach is to extract noise-aware residual representation R(z) from an image I, which disentangles generative noise patterns from semantic content, defined as:
The detection of Al-generated images (AIGI) is formulated as a binary classification task. Given an input image x E R Hxx neural network fo(-) predicts the probability p- fo( [0,1] I] that æ is synthesized by generative models. The training objective minimizes the cross-entropy
R(x) (xx),
(4)
3

---

PiD: Generalized Al-Generated Images Detection with Pixelwise Decomposition Residuals
Algorithm PiD Training Pipeline
Input: dataset D, neural network fa(+), transformation matrix M, quantization function Q(-)
Initialize the parameters 0 for fo(-).
for epoch I to nepochs do
for i 1 to niters do Fetch batch (It,, y4) from D
50
Misnoumry
sova
ADW
voDw
Biycoa
x I; x Mr
T Q(x() {Rounding or truncation]
x x; x M,,"
R₂ 24 - x2 (Compute residual representation)
pj fo(R2) (Neural network output)
Figure Comparison of RGB input and different image residual inputs. Models are trained on the SDv1.4 training set. The color conversion (CVT) error in the residual contributes most the generalization performance.
Compute LoE(Pi,
Update A with V9LCE
end for end for Return fo(.)
where R(x) represents the noise part of ((x) represents the intrinsic value of image Prior works (Wang et al., 2023; Tan et al., 2024c;d; Ricker et al., 2024) use different methods to estimate the function ((x) (c.g., low-frequency filters or the output of generation models), and the residual information extracted follows.
compression-based residual representation Reomp (1), sup- pose that (()) and E(-) are the encoder and decoder in the compression, the definition is as follows,
Frequency-based residuals:
Methods like FreqNet (Tan et al., 2024c) extract high-frequency components via:
Ro) D(E(s))
(6)
Taking the JPEG compression algorithm as an example, we explore and verify the effectiveness of the compression residual (eamp()) and the essential operations. The resid- ual information Reump (z) mainly includes two stages of quantization loss. One is the quantization loss during color space conversion, and the other is the quantization compres- sion loss of the blockwise DCT (discrete cosine transform) frequency components.
Rine(()) = = (F(x) O Mngh),
(5)
where F(-) is the Fourier transform and Mhigh is a high- pass filter. This equal to subtract the uww-rreyency components from the image and obtain the residual in- formation. However, the noise pattern cannot be fully captured by specific frequency bands.
Methods like DIRE (Wang et al., 2023) compute (xire = a, where D=G())) is the output of pre-trained generative model (e.g., diffusion models). However, the output inherits biases from the generator G(-), limiting generalization to unseen generators.
Reconstruction-bnn
residuals:
Experiments have found that the compression -based resid- ual representation effectively achieve generalization different generative models, as shown in Figure 3. However, if only the frequency-domate compression loss is included in the residual, the generalization effect is limited. This indicates that pixel-wise compression quantization of the image is the key to capturing the noise information of the image. The results reveal that simple pixelwise operation can effectively extract the noise patterns from the image.
3.2. Image Compression Residuals
We aim to find a more generalizable method to extract the residual representation R(x) from z for AIGI detection. To achieve this purpose, we have to consider how to approx- imate the intrinsic values of an image x. Notice that the compression algorithm, like JPEG, filters the noise infor- mation and maintains the visual quality of images. We first explore the residual information between the original image and the compressed image.
3.3. Pixelwise Decomposition AIGI Detection
We propose a pixelwise decomposition operation inspired by the color conversion. Suppose that an invertible transfor- mation matrix M2 R333 (e.g., YUV conversion matrix as shown in Figure 2) and a quantization function (like round- ing or truncation function) is applied to a pixel vector, the pixel vector can be decomposed into a quantized vector and residual vector. The formal definition of the pixelwise decomposition residual is given as follows.
Compression algorithms (e.g., JPEG) also have an encoder- decoder structure like many generative models. For the

---

PiD: Generalized Al-Generated Images Detection with Pixelwise Decomposition Residuals
Definition 3.1. With a invertible matrix Mr E R its inversion matrix Mf² E TR333 and quantization function Q(),, given an image I E [0, 255]sxHX the pixelwise decomposition residual is defined as
2021), LDM (Rombach et al., 2022), GLIDE (Nichol et al., 2021), and DALLE (Ramesh al., 2022). Different sampling strategies are applied for some of the DMs (i.e., LDM (Rombach et al., 2022) and GLIDE (Nichol et al.,
2021)). Multi-source real images (e.g., LSUN (Yu et al., 2015), ImageNet (Russakovsky et al., 2015), FaceForen- sics++ (Rossler et al., 2019a), and LAION (Schuhmann et al., 2021)) are collected to comprehensively evaluate the performance of detectors.
Rpid(z)= == x - Q( X1 Md) X1 M,
(7)
X1 is the operation of the mode-1 I lensor-matris product.
Our training pipeline takes Rpid(2) (4) as the input and detects synthetic images in the noise rather than the original RGB space. The detection model becomes fo (Ryai (z)), and the cross-entropy loss Leg is still the supervision during train- ing. The training pipeline is shown in Algorithm 1.
GenImage dataset (Zhu et al., 2024). This dataset is composed of synthetic images from advanced generative models (7 DMs and GAN method). These models are Midjourney (Mid, 2022), SDv (Rombach et al., 2022), SDv1.5 (Rombach et al., 2022), ADM (Dhariwal et al.,
The PiD residual (z) separates the noise information from the visual content of image 2, since the transfor- mation has almost no effect on the visual quality (where
2021). GLIDE (Nichol et al., 2021), Wukong ( (Wuk, 2022. 5). VQDM (Egiazarian et al., 2024), and BigGAN (Brock et al., 2018). Compared with other datasets, the visual quality of synthetic images in Genlmage is better and more challenging for many of the previous detection meth- ods. The varying resolutions in the Genlmage dataset also pose higher demands for the generalization ability of de- tection models.
[1)] << || Moreover, as the decomposition is applied to pixels independently, the noise information is well preserved. This residual representation is not limited to specific global or local frequency bands (as in R freg(1)) or affected by generative models' bias (as in Raire (x)) In the experiment section, we will show that PiD is generalizable over different generative models.
4. Experiment
Self-Synthesis GAN dataset (Tan et al., 2024c). 9 ad- vanced GAN techniques are included in this dataset to enrich the existing test scene (e.g., ForenSynths (Wang et al., 2020)). These models are AtGAN (He et al., 2019),
4.1. Setup
Training datasets. We consider different training settings following ForenSynths (Wang et al., 2020) and Genlm- age (Zhu et al., 2024) with ProGAN (Karras et al., 2018) or SDv1.4 1.44(4 (Rombach et al., 2022) as the generative model. The real images in ForenSynths and Genlmage are from LSUN (Yu et al., 2015) and ImageNet (Russakovsky al., 2015) dataset. There are 20 semantic classes of images in ForenSynths and we only use 4 of them (i.e., car, cat, chair, horse) during training to keep in line with previous works (Tan et al., 2024c;d; Liu et al., 2024).
BEGAN (Berthelot et al., 2017), CramerGAN (Belle- mare et al., 2017), InfoMaxGAN (Lee et al., 2021), MMDGAN (Li al., 2017). RelGAN (Nie et al., 2019). S3GAN (Lučié et al., 2019), SNGAN (Miyato al., 2018), and S3GAN (Lučié al., This dataset is challenging and provides a robust test scene for AIGI detection models trained on ForenSynths.
Implementation details. We implement the detector net- work with a simple customized ResNet architecture (Tan et al., 2024d: Li et al., 2024). The transformation matrix M, used in PiD is the matrix Myuv that maps the pixel value from RGB space YUV color space by default. Rounding (round) or truncation (floor) functions are utilized as the quantization function Q(-) in the implementation. An ad- ditional rounding operation is appended after the inversion transformation in the RGB space by default. We train the detector network for 50 epochs with batch size 64. The net- work is optimized with an SGD optimizer with a learning rate of 0.001.
Test datasets. To evaluate the generalization performance of different approaches in real-world scenarios, we test the models on 3 widely used datasets with 26 generative models. Synthetic images in these datases are generated by diverse GANs and DMs and real images are from different sources.
UniversalFakeDeteel dateset (Ojha et al., 2023). This dataset is composed of the test set from Foren- Synths (Wang et al., 2020) and some additional syn- thetic images generated by DMs. 11 generative mod- els (7 GANs and 4 DMs) are included during the test. These models are ProGAN (Karras et al., 2018), Cy- cleGAN (Zhu et al., 2017), BigGAN (Brock et al., 2018), StyleGAN (Karras et al., 2019), GauGAN (Park et al., 2019), StarGAN (Choi et al., 2018), Deep- fakes (Rossler et al., 2019b), Guided (Dhariwal et al.,
Metrics. We follow existing works (Ojha et al., 2023; Liu et al., 2024; Tan et al., 2024d) for benchmarking and re- port both average precision (AP) and classification accuracy (Acc). For Acc, we set the classification threshold for each dataset to 0.5 to ensure a fair comparison.
5

---

PiD: Generalized Al-Generated Images Detection with Pixelwise Decomposition Residuals
Table Cross-model accuracy (%) performance on the UniversalFakkeDtter Dataset. All models are trained on ForenSynths (ProGAN) under the 4-class setting. Bold and underline represent the best and second- best performance.
GAN
LDM
GLIDE
Methods
Venue
Pro-
Cycle-
Big-
Style- GAN
Gau-
Star- GAN
Deep Takes
Guided
200
200
100
100
50
100
DALLE
mAce
GAN
GAN
GAN
GAN
steps
widlg
steps
27
27
10
CNN-Spot
CVP020200
99.99
85.20
70:20
83.7
78.95
91.7
53.47
60.07
54,00
54,96
54,14
60,78
65.8
65.66
55.58
68,95
Patchfor
ECCV2020
75.03
68.47
79.16
63.94
75.54
67.41
76.5
75.77
74.81
68.52
67.91
71.71
Co-occurence
Elect. Imag.
97.70
63.15
53.75
92.50
51.1
54.7
57.1
60.50
70.7
70.55
71.00
70.25
69.60
69.90
67.55
68,00
Preq-spec
WIFS2019
49.90
50.50
49.90
50.30
99.70
50.10
50.40
50.30
51.40
50.40
57.05
F3Net
2020
99.38
76.38
65.33
92.56
58,10
104,0
63.48
69. 20
68,15
75.35
68, 8D
81.65
83.25
83.05
66. 3D
76.73
UnivFD
CVPR2023
100.0
98.50
94.55
82.00
99.50
97.00
66.60
70.03
94.19
73.76
94.36
79.07
79.85
78.14
86.78
86.29
LGrad
CVPR2023
99.84
85,39
$2.88
94.83
72.45
99.62
58.00
77.50
94.20
95.85
94.80
87.40
90.70
89.55
88.35
87.42
PregNet
AAA12024
97.90
95.84
90.45
97.55
90.24
93.41
97.40
86.70
84.55
99.58
65.56
85.69
97.40
88.15
59.06
88.63
NPR
2VP4
99.84
95.00
87:55
96.23
86.57
99.75
76.89
84.55
97.65
98.00
98, 20
96.25
97.15
97.35
87.15
93.21
FatFormer
CVPR2022
99.89
99.32
99.50
95.15
99.41
99.75
93.23
76.00
98.60
94.90
98.65
94.35
94.65
94,20
98.75
95.89
C2P-CLIP
AAA12025
99.98
97.31
99. 12
96.44
99.17
99.60
93.77
69.10
99.25
97.25
99.30
95.25
96.
98.55
95.70
RID (Myuv, round)
99.81
99, 76
93.79
99,85
100,0
91.54 34
95.45
82,60
99.95
99.95
99,44
99.30
99.30
99,30
83.55
96.22
PID (Myuyy (Boor)
100.0
98.57
86.06
97.54
99.95
85.30
95.06
96.60
98.65
98.55
98.10
98.60 60
98.45
98.55
87.35
95.82
Table 2. Cross-model Average Precision (AP) Performance on the UniversalFakeDDteee Dataset. Bold and underline represent the
best and second-best performance.
GAN
LDM
GLIDE
Methods
Venue
Pro-
Cycle-
Big-
Style-
Star-
Deep fakies
Guided
200
100
50
DALLE
mAP
GAN
GAN
GAN
GAN
GAN
GAN
w/llg
stcps
27
27
10
CNN-Spot
CVPR2020
100.0
93.47
84.5
99.54
89.49
98.15
89.02
73.72
70.62
71.0
70.54
80.65
84.91
82.07
70.59
83.88
Patchfor
ECCV2020
80.88
72.84
71.66
85.75
65.99
69.25
76.55
75.03
87.1
86.72
86.4
85,37
83.73
78.38
75.67
78.75
Co-occureace
Elect. Imag.
99.74
80.95
50.61
98.63
53.11
67.99
59.14
70.20
91.21
89.02
92.39
89.32
88.35
82.79
80.96
79.6. 63
Freq-spec
WIFS2019
55,39
100.0
55.11
100.0
45.18
57.72
77.72
77.25
76.47
64.58
61.92
67.77
69
F3Net
ECCV2020
99.96
84.32
69.90
99.72
56.71
100.0
78.82
70.53
73.76
81.66
74.62
89.81
91.04
90.36
71,84
82.24
UnivED
CVPR2023
100.0
99.46
99. 59
97.
99.98
99.60
82.45
87.77
99. 14
92.15
99.17
94.74
95.34
94.57
97.15
95
LGrad
CVPR2023
100.0
93.98
90.69
99.86
79.36
99.98
67.91
87.06
99:03
99.16
99.18
93,23
95,10
94,93
97.22
93.11
FreqNet
AAAI2024
99.92
99.63
96.05
99.89
99.71
98.63
99.92
96.27
96.06
100.0
62.34
99.80
99.78
96.39
77.78
94.81
NPR
CVPR2024
100.0
99.53
94.53
99.94
88.82
100.0
84.41
98.26
99.92
99.91
99.92
94.87
99.89
99.92
99.26
97.61
FatFormer
CVP220024
100.0
100.0
99.98
99.75
100.0
100.0
97 99
91.99
99.81
99.09
99.87
99.13
99:41
99.20
82
99.07
C2P-CLIP
AAA12025
100.0
100.0
99.50
100.0
96.59
94.13
99.98
72
99.79
99.83
99.91
98
PID (Myry, round)
99.99
100.0
94.98
99.95
100.0
96.93
97.58
93,28
100.0
100.0
99.75
99.77
99.
99.96
91.73
98. 24
PD (Myuy, dloor)
99.97
99.98
92.01
99.04
100.0
90.75
97.58
99.18
99.39 89
99.82
99.52
99.87
99.91
99.88
94.26
98.1
4.2. Cross-Model Evaluation
putational efficiency with simple pixelwise transformation and lightweight network structure and surpass previous representation--basee and pretraining-based methods. The proposed method achieve a new tath-offthhe-rt result with an average accuracy of 96.22%, compared with NPR with 93.21% % and FatFormer with 95.89%. The mAP of 98.24% is also competitive compared with prtraining-basee methods like FatFormer and C2P-CLIP.
Evaluation on SniversalFakeDDteee The test results on UniversalFakelDtted are illustrated in Table 1 and Table 2, and the accuracy and the AP on each subset is reported. All the detection models are trained on the training set of ForenSynths with single generative model ProGAN (Kar- ras et al., 2018). Cross-model test is challenging for early detection methods like CNN-Spot (Wang et al., 2020), Patch- for (Chai et al., 2020), Co-occurence (Nataraj et al., 2019) and Freq-spec (Zhang et al., 2019). The average accuracy over 15 test sets is below 71.71%. Methods that focus on low-level representation like specific frequency compo- nents or image-level network gradients, i.c., F3Net (Qian et al., 2020), LGrad (Tan et al., 2023b), FreqNet (Tan et al., 2024c), and NPR (Tan et al., 2024d). achieve better gner- alization performance. NPR achieves an average accuracy of 93.21% %, which leverages the local high-frequency in- formation as input of the detector. Currently, some meth- ods, i.e., Ui (Ojha et al., 2023), FatFormer (Liu et al., 2024), and C2P-CLIP (Tan et al., 2024b), find that utiliz- ing pre-trained large visual backbone network (e.g.. CLIP ViT-L (Radford et al., 2021)) can achieve remarkable per- formance in AIGI detection. Our method PiD shows com-
Evaluation on GenImage. To verify the generalization capability of the proposed method, we also test the models on another benchmark GenImage with advanced diffusion models as the training and test set. All the detection models are trained on the training set with SDv1.4 as the generative model. Some reconstruction--ant based methods use diffusion reconstruction to extract residual information in the RGB space, e.g., DIRE (Wang et al., 2023), or in the latent space, e.g.. LARE² (Luo et al., 2024) and achieves great detection performance on diffusion models. However, the model bias of generative models may limit the generalization capability of the reconstruction-basse based method. As shown in Table 3, our method also achieves a new state-of-the-art result with an average accuracy of 98.0% over generative models. PiD surpass the reconstruction- baased method LARE² by 11.8%
6

---

PiD: Generalized Al-Generated Images Detection with Pixelwise Decomposition Residuals
Table Cross-model accuracy (Ace) performance on the Genimage Dataset. The SDv1.4 is employed as the training set following
(Zhu et al., 2024). The results of ResNet-50, DeiT-S, Swin-T, CNNSpot, Spec, F3Net, and GramNet are from GenImage (Zhu et al., 2024). Bold and underline represent the best and second- best performance.
Method
Venue
Midjourney
SDv1.4
SDv1.5
ADM
GLIDE
Wukong
VQDM
BigGAN
mAcc
ResNet-50 (He et al., 2016)
CVPR2016
54.9
99.9
99.7
53.5
61.9
98.2
56.6
52.0
72.1
DeïT-S (Touvron et al., 2021)
ICML2021
55.6
99.9
99.8
49.8
58.1
98.9
56.9
53.5
71.6
Swin-T (Liu al,, 2021)
ICCV2021
62.1
99.9
99.8
49.8
67.6
99.1
62.3
57.6
74.8
CNNSpot (Wang al., 2020)
CVPR2020
52.8
96.3
95.9
50.1
39.8
78.6
53.4
46.8
64.2
Spee (Zhang et ul., 2019)
WIFS2019
52.0
99.4
99.2
49.7
49.8
94.8
55.6
49.8
68.8
F3Net (Qian et al., 2020)
ECCV2020
50.1
99.9
99,9
49.9
50.0
99.9
49.9
49.9
68.7
GramNet (Liu et al., 2020)
CVPR2020
54.2
99.2
99.1
50.3
54.6
98.9
50.8
51.7
69,9
UnivFD (Ojha et al., 2023)
CVPR2023
93.9
96.4
96.2
71.9
85.4
94.3
81.6
90,5
88,8
DIRE (Wang al., 2023)
ICCV2023
50.4
100,0
99.9
52.3
67.2
100.0
50.1
50.0
71.2
FreqNett (Tan al., 2024c)
AAA12024
89.6
98.8
98.6
66.8
86.5
97.3
75.8
81.4
86.8
NPR (Tan et al., 2024d)
CVPR2024
$1.0
98.2
97.9
76.9
89.8
96.9
84.1
84.2
88.6
FatFormer (Liu et al., 2024)
CVPR2024
92.7
100.0
99.9
75.9
88.0
99.9
98.8
55.8
88.9
LARE (Luo al., 2024)
CVPR2024
74.0
100.0
99.9
61.7
88.5
100.0
97.2
68.7
86,2
DRCT (Chen al., 2024)
ICML,2024
91.5
95.0
94.4
79.4
89.2
94.7
90.0
81.7
89.5
Effort (Yan al., 2024h)
ICML.2025
82.4
99.8
99.8
78.7
93.3
97.4
91.7
77.6
91.1
C2P-CLIP (Tan et ul., 2024b)
AAA12025
88.2
90.9
97.9
96.4
99.0
98.8
96.5
98.7
95.8
PiD (Myuv, round)
97.2
99.5
99.4
96.3
99.0
98.8
95.8
98.3
98.0
PiD (Myuv. floor)
95.5
99.6
99.5
96.0
98.5
99.3
97.8
96.2
97.8
Table 4. Cross- Grosores evaluation on the Self-Synthesis 9 GANs dataset. Ace and AP are reported for comparison. Bold and underline represent the best and second- best performance.
Method
Ace
ABGAN
AP
Anc
BEGAN
AP
CramerGAN
Acc
AP
InfeMaGGNN
Ace
AP
Acc
MMDDAN
AP
Ace
RelGAN
AP
Anc
SSGAN
AP
Acc
SNGAN
AP
Adc
STGAN
AP
Ace
Mean
AP
CNNDetection (Wange) et 2020)
51.1
83.7
50.2
44.9
81.3
97.3
71.1
91.7
72.9
98.4
53.3
82.1
55.2
60.
62.7
910.4
0.300
92.77
62.3
82.9
Frank (Frank 2020)
65.0
74.4
39.4
39.9
31.0
36.0
41.1
41.0
38.4
40.5
69.2
96.2
69.7
$1.9
48.4
47.9
25.4
34,0
47.5
54,7
Durali (Darall et 2020)
39.9
38.2
30.9
60.9
67.2
50.1
51.7
39.5
65.5
88.2
97.0
58.9
62.1
72.5
603.3
63.3
Parchfor (Chai et 2020)
68.0
92.9
97.1
100.0
97.8
99.9
93.6
98.2
22.9
100.0
99.6
100.0
66.8
68.1
97.6
99.8
92.7
99.8
90.1
95.4
F3Net (Qian et al., 2020)
85.2
94.8
87.1
97.5
89.5
99.8
67.1
83.1
73.7
99.6
95.8
100.0
65.4
70.0
51.6
93.6
60.3
99.9
75.4
93.1
SelfBlend (Staobura et 2022)
63.1
56.4
59.0
75.1
82.5
74.0
77.5
53.9
61.2
66.7
GANDesection (Mundelli ot al., 2022)
57.4
75.1
67.9
100.0
67.8
99377
67.6
92.4
61.7
99.3
60.9
86.2
69.6
83.5
66.7
90.5
69.6
97.2
66.1
91.6
LGrad (Tan et ol., 20033)
68.6
91.8
69.9
89.2
50.3
$4.0
71.1
82.0
$7.5
67.3
59.1
99.1
78.5
86.0
78.0
87.4
54.8
68.0
68.6
80.8
UnivED (Ojha
2023)
78.5
98.3
98.9
77.6
98.9
77.6
99.7
98.1
77.6
74.2
98.8
NPR (Jan et al., 2024d)
83.0
96.2
94.0
99.8
98.7
9510
94.5
98.3
98.6
99.0
99.6
100.0
79.0
80.0
88.8
97.4
98.0
100.0
93.1
96.6
RDD (My un. round)
100,
100.0
99.9
160.0
95.4
99.7
05.4
99.8
95.4
99.8
100.0
100.0
85.7
96.4
05.4
99.8
85.0
99.5
94.7
99.4
(Myre. (lour)
100.0
100.0
100,0
97.5
99.5
100.0
91.2
99.9
the low-level representation-busee method NPR by 9.4%,
value range. Maitg (llMasayll < 1) is a simple diagonal matrix and only scales the RGB value before the quanti- zation. On the one hand, the results in Table 6 illustrate that even using the simple Maiag can effectively improve the generalization performance of detection models. This indicates that the pixelwise decomposition can extract the essential noise information for AIGI detection. On the other hand, the choice of M, is still important to the detection performance, and Myev achieves the best overall accuracy. See the Appendix for the detailed information on the matrix used in the ablation.
and the pretraining- based method C2P-CLIP by 2.2%.
Evaluation on Synthesstss.. To comprehensively evalu- ate the performance detection models over different GAN sources, we test models on Self-Synthesis with advanced GAN models. All the models are trained on the training set of FynehSy Most previous methods cannot generalize well on this dataset. As in Table 4, our method surpasses the second-best best NPR method (Tan et al., 2024d) by 1.2% on the average accuracy and by 2.8% on mAP.
4.3. Ablation Study
Ablation on the scaling of matrix M,. The transforma- tion matrix M, can affect the length of the value range of the mapped pixel vector, thus controlling the intensity RRaa(x)) of the residual representation. By scaling the M, (Myuv here) we can study the influence of [Raa(()) on the performance. As shown in Figure 5, we measure the intensity of residual with MSE between the original pixel value and transformed pixel value. When M, is scaled with factor larger than 1.0 (1.5 or 2.0), the average intensity of
Ablation on the transfomation matrix M,. We explore whether the performance of PiD is sensitive to the choice of transformation matrix M, on GenImage. Four matrix are used in this ablation as shown in Table 6. Myuv, MxYz, and Meustom map the pixel value from RGB color space to another color space. All these matrices has the same 11-norm || 1 and do not change the length of the
7

---

PiD: Generalized Al-Generated Images Detection with Pixelwise Decomposition Residuals
Synthetic Images
Real Images
Figure Visualization GradCAM (Selvaraju et al., 2017) on Genlmage. We visualize the GradCAM of baseline RGB model (the 3rd column) and our residual model (the 4th column). The normalized residual information is also visualized in the 2nd column.
Table S. Ablation of the mapped value range Genlmage by scaling M,. The matrix M, here is Myuv. and the residual intensity influenced by the scaling.
MSE (Log Scale)
10a
Scaling factor Midjoumny
SDv1.4
ADM
BigGAN
0.2
93.6
99.2
87.4
91.2
0.5
96.7
98.7
92.8
97.9
10
0.8
92.6
98.8
92.0
91.3
95.5
99.6
96.2
1.5
84.6
93.1
69.0
79.6
79.6
93.3
63.1
76.4
0.5
1.0
1.5
2.0
Scaling Factor
Figure 5. The pixel-level decomposition residuals vary intensity based on different scaling factors. We compute the residual in- tensity over 10,000 randomly sampled pixel values. Log scale is applied for better visualization.
Table 6. Ablation of the transformation matrix M. PiD on Gen- Image. Four types of M, are used in the ablation, Myuv: YUV color transformation, Mxyz: XYZ color transforationn, Maieg:
diagonal matrix, Moustom. customized ralk-rank matrix.
Model
Midjourney
SDv1.4
ADM
BigGAN
residual drops (z)) < and causes sparse residual representation. Evaluation results GenImage in Table 5 illustrate that large scaling factor (sparse residual repre- sentation) causes large generalization performance drop. However, the generalization remains stable when using scaling factor smaller than 1.0 from the results. Therefore, is recommended to keep the 1l 1o-norm of M, smaller than 1.0 (I) Mill < 1) in the application of PiD.
Base (RGB)
67.5
98.7
55.9
61.6
Myuv
95.5
99.6
96.0
96.2
MxYZ
96.5
97.8
96.5
81.6
Maiag
88.2
94.2
88.3
88.4
Menstom
87.2
96.5
89.4
91.7
images exhibit some differences from the visualization. The residual of synthetic images likely share the same pat- tern within local region. From the attention map, the RGB model (the 3rd column) focus more on semantic object in the image. Compared with the baseline model, our residual model can distinguish the synthetic images from real im- ages in the attention map. The results further illustrate the significance the residual information AIGI detection.
Visualization of the GradCAM. We visualize the atten- tion of detection models with GradGAM (Selvaraju al., 2017) in Figure 4. The residual of PiD is also visualized in the 2rd column. The synthetic images are generated from Midjourney (Mid, 2022), SDv1.4 (Rombach et al., 2022), ADM (Dhariwal et al., 2021) and BigGAN (Brock et al., 2018). The residual patterns between real and synthetic
8

---

PiD: Generalized Al-Generated Images Detection with Pixelwise Decomposition Residuals
5. Conclusion
Chen, B., Zeng. J., Yang, J., and Yang. R. Dret: Diffu- sion reconstruction contrastive training towards universal detection of diffusion generated images. In Forty-first International Conference on Machine Learning, 2024.
This paper has introduced PiD, an effective AIGI detection method that focuses on residual signals within images. By disentangling residual components from images, PiD un- covers underlying generation clues independent of semantic content, offering computationally efficient and generaliz- able approach. Extensive cross-model experimental results have demonstrated the remarkable generalization perfor- mance of the proposed method. Future work could explore further optimization of the method and its application a wider range of fake image detection scenarios. We hope that the findings in this work can also inspire the improvement of generative models.
Chen, L. et al. Self superviee learning of adversarial exam- ple: Towards good generalizations for deepfake detection. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition, pp. 1p.1887 18710-18719, 2022.
Cheng, J., Yan, Z., Zhang, Y., Luo, Y., Wang, Z., and Li, C. Can we leave deepfake data behind in training deepfake detector? Advances in Neural Information Processing Systems, 2024.
Acknowledgements
Choi, Y. al. Stargan: Unified generative adversarial net- works for multi domain image- tange-to-image translation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.
This work is supported in part by National Science Foun- dation for Distinguished Young Scholars under Grant 62225605, Project 12326608 supported by NSFC, "Pio- neer" and "Leading Goose" R&D Program of Zhejiang (No.2025C02014), Ningbo Science and Technology Special Projects under Grant No. 20252028, and the Fundamental Research Funds for the Central Universities.
2018.
Chollet, F. Xception: Deep learning with depthwise separa- ble convolutions. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1251- 1258, 2017.
Dhariwal, P. al. Diffusion models beat gans on image synthesis. Advances in Neural Information Processing Systems, 34:8780-8794, 2021.
Impact Statement
This paper presents work whose goal is advance the field of Application-Driven Machine Learning, An Al-generated image detection method is studied and proposed in this paper. The proposed method has demonstrated potential in preventing the malicious applications of generative models and deepfakes, and may produce a positive social impact.
Durall, R. et al. Watch your up-convolution: Can based generative deep neural networks are failing reproduce spectral distributions. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pp. 7890-7899, 2020.
Egiazarian, V., Kuznedelev, D., Voronov, A., Svirschevski, R., Goin, M., Pavlov, D., Alistarh, D., and Baranchuk, D. Accurate compression of text-to-image diffusion models via vector quantization. arXiv preprint arXiv:2409.004: 2024.
References
Midjourney. Inhttps:/www.iiddooo com/ home/, 2022
Wukong, 2022. 5. Inhttps://xiher mi mispore.. cn/modelzoo/wiin /wkkoog 5.
Frank, et al. Leveraging frequency analysis for deep fake image recognition. In International Conference on Machine Learning, pp. 3247-3258, PMLR, 2020.
Bellemare. M. G. al. The cramer distance as so- lution to biased wasserstein gradients. arXiv preprint 170..17305.0743. 2017.
Fu, X., Yan, Z.., Yao, T., Chen, S., and Li, X. Exploring unbiased deepfake detection via levelll shuffling and mixing, arXiv preprint arXiv:2501.0433
Berthelot, D. et al. Began: Boundary equilibrium generative adversarial networks. arXiv preprint arXiv:1703. 10717, 2017.
2025.
Haliassos, A. et al. Lips don't 't lie: A generalisable and robust approach to face forgery detection. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pp. 5039-5049, 2021.
Brock, A. et al. Large scale gan training for high fidelity natural image synthesis. In International Conference on Learning Representations, 2018
Chai, L. et al. What makes fake images detectable? under- standing properties that generalize. In European Confer- ence on Computer Vision, pp. 103-120. Springer, 2020.
He, K. et al. Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770-778, 2016.

---

PiD: Generalized AI-Generated Images Detection with Pixelwise Decomposition Residuals
He, Z. al. Attgan: Facial attribute editing by only chang- ing what you want. IEEF Transactions on Image Process- doi: 10.1199/
Liu, Z. et al. Global texture enhancement for fake face detection in the wild. In Proceedings of the IEEF/CVE Conference on Computer Vision and Pattern Recognition, pp. 8060-800000000 8069, 2020.
ing, 28(1))5444-5478 2019. 2916751.
Ho, J., Jain, A., and Abbeel, P. Denoising diffusion proba- bilistic models. Advances in neural information process- ing systems, 33:6840-6851, 2020.
Lučié, M. et al. High-fidelity image generation with fewer labels. In International Conference on Machine Learning. pp. 4183-4199 PMLR, 2019.
Jeong, Y. et al. Bihpf: Bilateral high-pass filters for robust deepfake detection. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision pp. 48-57, 2022.
Luo, Y., Du, J., Yan, K., and Ding, S. Lare" 2: Latent re- construction error based method for diffusion- diffusiin--enerated image detection. In Proceedings of the IEEE/CVF Con- ference Computer Vision and Pattern Recognition, pp. 17006-17015, 2024.
Karras, T. et al. Progressive growing of gans for improved quality, stability, and variation. In International Confer- ence on Learning Reprexentations, 2018.
Luo, Y. et al. Generalizing face forgery detection with high- frequency features. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16317-16328 2021.
Karras, T. et al. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 4401-4410, 2019.
Mandelli, S., Bonettini, N., Bestagini, P., and Tubaro, S. Detecting gan-generated images by orthogonal training of multiple enns. In 2022 IEEE International Conference Image Processing (ICIP), pp. 3091-3095. IEEE, 2022.
Lee, K. S. et al. Infomax-gan: Improved adversarial image generation via information maximization and contrastive learning. In Proceedings of the IEEE/CVF winter Confer- ence on applications of Computer Vision, pp. 3942-3952, 2021.
Masi, I. et al. Two-branch recurrent network for isolating deepfakes in videos. In European Conference on Com- puter Vision, pp. 667-684. Springer, 2020.
Li, C.-L. et al. Mmd gan: Towards deeper understanding of moment matching network. In Advances in Neural Information Processing Systems, volume 30, 2017.
Miyato, T. et al. Spectral normalization for generative ad- versarial networks. arXiv preprint arXiv: 1eX2::1802.0595. 2018.
Li, L. et al. Face x-ray for more general face forgery de- tection. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition. pp. 5001- 5010, 2020.
Nataraj. L., Mohammed, T. M., Chandrasekaran, S., Flen- ner, A., Bappy, J. H., Roy-Chowdhury, A. K., and Manju- nath, B. Detecting gan generated fake images using co- occurrence matrices. arXiv preprint arXiv:1903. 3.66666, 2019.
Li, O., Cai, J., Hao, Y., Jiang, X., Hu, Y., and Feng, F. Im- proving synthetic image detection towards generalization: An image transformation perspective. arXiv preprint 2rXiv:2408.067411 2024.
Nichol, A., Dhariwal, P., Ramesh, A., Shyam, P., Mishkin, P., McGrew, B., Sutskever, I., and Chen, M. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. arXiv preprint arXiv: 10. 2021.
Li, Y. et al. In ictu oculi: Exposing ai created fake videos by detecting eye blinking. In 2018 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1-7. IEEE, 2018
Nie, W. et al. Relgan: Relational generative adversarial networks for text generation. International Conference on Learning Representations, 2019.
Liu, H., Tan, 7., Tan, C., Wei, Y., Wang, J., and Zhao, Y. Forgery-aware adaptive transformer for generalizable syn- thetic image detection. In Proceedings of the IEEE/CVF Conference Computer Vision and Puttern Recognition, pp. 10770-107888 10780, 2024.
Ojha, U. et al. Towards universal fake image detectors that generalize across generative models. In Proceedings of the IEEF/CVE Conference on Computer Vision and Pattern Recognition, pp. 24480-24489, 2023.
Liu, Z.,, Lin, Y., Cao, Y., Hu, H., Wei, Y., Zhang, Z., Lin, S., and Guo, B. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 10012-10022, 2021.
Park, T. et al. Semantic image synthesis with spatially- adaptive normalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2337-2346, 2019.
10

---

PiD: Generalized AI-Generated Images Detection with Pixelwise Decomposition Residuals
Qian, Y. et al. Thinking in frequency: Face forgery de- tection by mining frequency-aware clues. In European Conference on Computer Vision, pp. 86-103, Springer, 2020.
Tan, C., Zhao, Y., Wei, S., Gu, G., and Wei, Y. Learn ing gradients: Generalized artifacts representation for gan-generated images detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 12105-121 14, June 2023a.
Radford, A. et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, pp. 8748-8763. PMLR, 2021.
Tan, C., Liu, P.. Tao, R., Liu, H., Zhao, Y., Wu, B., and
Wei, Y. Data-independent operator: A training-fre free arti- fact representation extractor for generalizable deepfake detection. arXiv preprint arXiv:2403.0680; 2024a.
Ramesh, A., Dhariwal, P., Nichol, A., Chu, C., and Chen, M. Hierarchical text-conditional image generation with clip latents. arXiv preprint wrXv:22044006125, 2022.
Tan, C., Tao, R., Liu, H., Gu, G., Wu, B., Zhao, Y., and Wei, Y. C2p-clip: Injecting category common prompt in clip to enhance generalization in deepfake detection. arXiv preprint arXiv:2408. 09647, 2024b.
Ricker, J., Lukovnikov, D., and Fischer, A. Aeroblade: Training-free detection of latent diffusion images using autoencoder reconstruction error. In Proceedings of the IEEE/CVF Conference on Computer Vision and Patlern Recognition, pp. 1130--940,, 2024.
Tan, C., Zhao, Y., Wei, S., Gu, G., Liu, P., and Wei, Y. Frequency-aware deepfake detection: Improving gener- alizability through frequency space domain learning. In Proceedings of the AAAI Conference on Artificial Intelli- gence, volume 38, pp. 5052-5060, 2024c.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF con- ference on computer vision and pattern recognition, pp- 10684-10695, 2022.
Tan, C., Zhao, Y., Wei, S., Gu, G., Liu, P., and Wei, Y. Rethinking the up-sampling operations cnn-based gen- erative network for generalizable deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 28130-28111 2024d.
Rossler, A., Cozzolino, D., Verdoliva, L.,, Riess, C., Thies, J., and Nießner, M. Faceforensics+#: Learning to de- tect manipulated facial images. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 1-11, 2019a.
Tan, C. et al. Learning on gradients: Generalized artifacts representation for gan-generated images detection. In Pro- ceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR), pp. 12105-12114, June 2023b.
Rossler, A. et al. Faceforensics+#: Learning to detect ma- nipulated facial images. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp- 1-11, 2019b.
Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., and Jégou, H. Training data-efficient image transform- ers & distillation through attention. In International Con- ference on Machine Learning, pp. 10347-10357. PMLR, 2021.
Russakovsky, O. et al. Imagenet large scale visual recogni- tion challenge. International Journal of Computer Vision, 115(3):211-252 2015.
Van der Maaten, L. and Hinton, G. Visualizing data using t-sne. Journal of machine learning research, 9(11), 2008.
Schuhmann, C., Vencu, R., Beaumont, R., Kaczmarczyk,
R., Mullis, C., Katta, A., Coombes, T., Jitsev, J., and Komatsuzaki, A. Laion-400m: Open dataset of clip- filtered 400 million image-text pairs. arXiv preprint 10X0::2111.02114,.0 2021.
Wang, S.-Y. et al. Cnn-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8695-8704, 2020.
Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., and Batra, D. Grad-cam: Visual explana- tions from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on computer vision, pp. 618 618-626, 2017.
Wang. Z., Bao. J., Zhou, W., Wang, W., Hu, H., Chen, H., diffusion-generated
and Li, H. Dire for diffusion- generated image detection. In Proceedings of the IEEE/CVF International Confer- ence on Computer Vision, pp. 22445-22443 2023.
Woo, S. et al. Add: Frequency attention and nieti-view based knowledge distillation to detect low-quality com- pressed deepfake images. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp. 122- 130, 2022.
Shiohara, K. et al. Detecting deepfakes with self-blended images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 18720 18729, 2022.

---

PiD: Generalized Al-Generated Images Detection with Pixelwise Decomposition Residuals
Wu, H., Zhou, J., and Zhang, S. Generalizable synthetic image detection via language-guider contrastive learning. arXiv preprint 2at:::230..8000 2023.
Yan, Z., Zhang, Y., Fan, Y., and Wu, B. Ucf: Uncovering common features for generalizable deepfake detection. In Proceedings of the IEFF/CVF International Conference Computer Vision, pp. 22412-22423, 2023.
Yan, Z.,, Luo, Y., Lyu, S., Liu, Q., and Wu, Transcending forgery specificity with latent space augmentation for generalizable deepfake detection. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 8984 8994,999442 2024a.
Yan, Z., Wang, J., Wang. Z., Jin, P., Zhang, K.-Y., Chen, S., Yao, T., Ding, S., Wu, B., and Yuan, L. Effort: Efficient orthogonal modeling for generalizable ai- ai-generated im- age detection. arXiv preprint arXiv:24/ 156633, 2024b.
Yan, Z., Yao, T., Chen, S., Zhao, Y., Fu, X., Zhu, J., Luo, D., Wang, C., Ding, S., Wu, Y., al. DE40: Toward next- generation deepfake detection. In Advances in Neural Information Processing Systems, 2024c.
Yan, Z., Ye, Li, W., Huang, Z., Yuan, S., He, X., Lin, K., He, J., He, C.. and Yuan, Gpt-imgeval: comprehen- sive benchmark for diagnosing gpt4o in image generation. arXiv preprint arXiv:5504.02782. 2025.
Yu, F. et al. Lsun: Construction of large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv: arXiv:/506.000 1506.03365. 2015.
Zhan, F., Yu, Y., Wu, R., Zhang, J., Lu, S., Liu, L., Ko- rtylewski, A., Theobalt, C., and Xing, E. Multimodal image synthesis and editing: A survey and taxonomy. IEEE Transactions Pattern Analysis and Machine In- telligence, 2023.
Zhang, X. et al. Detecting and simulating artifacts in gan fake images. In 2019 IEEE International Workshop In- formation Forensics and Security (WIFS), pp. 1-6. IEEE, 2019.
Zhu, J.-Y. et al. Unpaired image-to-image image translation using cycle-consistent adversarial networks. In Proceedings of the IEEE International Conference on Computer Vision, pp. 2223 22322, 2017.
Zhu, M., Chen, H., Yan, Q. Huang, X., Lin, G., Li, W., Tu, Z., Hu, H., Hu, J., and Wang, Genimage: A million-scale benchmark for detecting ai- ai-generated image. Advances in Neural Information Processing Systems, 36 2024.
12

---

PiD: Generalized Al-Generated Images Detection with Pixelwise Decomposition Residuals
A. Transformation Matrix
Details for the transformation matrix used Table 6, Myuv, Mxyz, Maing and Moustom are presented in this section. Myuv. x and Mustom are normal full-rank matrix. The 11-norm of these matrices are the same (|] 1). Maing full-rank diagonal matrix.
0.299
0.587
0.114
1.0
0.0
1.402
Myuv
0.168736
0.331264
0.5
Myuvv
1.0
-0.344136
-0.714136
0.5
0,418688
0.081312
0..11688 0.5
-0.081312
0..12453
0.357580
0.180423
3.240479
-1.337150
- 00.498535
Mxyz
0.212671
0.715160
0.072169
.MxYz
-09969256
1.875991
0.041556
0.019334
0.119193
0.950227
0.055648
00.204043
1.057311
T0.06
0.63
0.27
1.1844
1.5685
1.3482
M Mustom
0.3
0.04
0..5
.M11
0.9909
0.4756
-0.5945
custom
0.34
-0.6
0.17
1.1284
-.4588
1.0876
0.412453
0.0
0.0
2.424519
0.0
0.0
Maiag= =
0.0
0.715160
0.0
0.0
1.398288
0.0
diag
0.0
0.0
0.950227
0.0
0.0
1.05238
B. Cross-Model Evaluation
SDv1.5
StyleGAN2
ADM
SDv1.4
BigGAN
StyleGAN
GLIDE
Midjourney
CycleG
PrOGAN
WuKong
BigGAN
StarGAN
Deepfakes
VQDM
GauGAN
FreqNet
NPR
UnivFD
PiD (Ours)
Figure 6. Cross-model accuracy (Acc) performance on GenImage (left) and ForenSynths (right) datasets.
B.I. Comparison with Frequency and Pretrained Models
We visualize the evaluation results in Figure 6. Compared with other low-level residual- based methods like FreqNet (Tan et al., 2024c) and NPR (Tan et al., 2024d), our method achieves better generalization performance on some generative models like ADM (Dhariwal et al., 2021), VQDM (Egiazarian et al., 2024), BigGAN (Brock et al., 2018), and Deepfakes (Rossler et al., 2019b). The residual information used in PiD is not limited to high-frequency information only and can generalize to more synthesis methods. Compared to the pretraining-bast better overall detection performance. The results illustrate the effectiveness and efficiency of our method.
UnivFD with large ViT backbone, our model also achieves a
B.2. Comparison with LARE² on Multi-Source Training Set
To validate whether the performance is sensitive to the generative models used during training, we test models trained on different training sets on Genlmage. As shown in Figure 7, we compare our model with LARE² (Luo al., 2024),
13

---

PiD: Generalized Al-Generated Images Detection with Pixelwise Decomposition Residuals
LARE
RD (Ours)
47.5
74.0
10.00
47.2
75.
24.0
200.3
2000
0
$5.4
120.0
94.0
0.77
01.
562
90.5
S6.0
95.7
$6.7
$6.3
$7.3
62.1
07
92.5
22.4
04.2
03-7
22.
04.7
26.7
95.2
25.2
90.0
WORKOTS
10
Wilkons
97.5
22.0
200.2 20
110.0
26.2
68.0
75.7
56.
22.4
50.4
22.5
20.2
22.4
52.1
85.0
VODM
VOOM
19.3 49.4
64.3
62.
991
15.3
94.3
59.7
16.8
99
15.9
16.5
97.
923
10.
12.5
BapOAN
BREGAN
360
30.
50.0
202
100.5
51.2
842
84.1
88.0
25.8
072
50.
14
Bipdsl
Testonn
on
Figure 7. Cross-model evaluation with different training sets on GenImage. We compare the performance with LARE* with different training
which is reconstruction residual-base based method in the latent space. The performance of LARE² is great when training on the SD model, but it cannot generalize well when training on other DM or GAN models like GLIDE or BigGAN. Since the reconstruction method usually relies on specific models like SD to extract residuals, the model bias may hinder the generalization of these methods. Our method does not require a generative model to extract residuals and achieves great generalization performance with different training sets as shown in Figure
C. Visualization
Baseline (ResNet)
UnivED (CLIPVIT-L)
PID (ResNet)
Figure 8. The t-SNE visualization of RGB (haseline and UnivFD) and residual (PiD) detection models GenImage. With RGB images as input, real and synthetic images cannot be easily separated in the feature space. The residual information is less influenced by the visual content information. The real images (blue points) distinguished from synthetic images in the feature space of residual models.
Visualization of the feature space. To explore the effectiveness of residual representation, visualize the feature space of RGB and residual detectors with t-SNE (Van der Maaten & Hinton, 2008) GenImage. As shown in Figure 8, with RGB input, real and synthetic images cannot be simply separated in the feature space of the baseline model. For UnivFD, which utilizes a frozen ViT-L. (CLIP) hackbone and generalizes well on some generative models, some images are clustered the feature space. However, real images are still not clustered and cannot be distinguished. The residual representation in PiD less influenced by the visual semantic information. Real images are clustered in the feature space of the residual detector and separated from synthetic images. The results further demonstrate the effectiveness of our method in AIGI detection.
D. Computational Cost
Our method shows an advantage in the computational cost compared with previous methods, as shown in Table 7. First, our method does not increase the learnable parameter numbers of the detector and requires a light weight CNN network only. The overall number of parameters (#Params.) and operations (GFLOPs) is much lower than some methods that rely on pretrained networks like UnviFD (Ojha al., 2023). Second, the computational cost of the proposed pixelwise
14

---

PiD: Generalized Al-Generated Images Detection with Pixelwise Decomposition Residuals
Model
#PParas.
GFLOPs
Inference Time (ms)
Baseline (RGB)
1.4M
1.73
29.13
FreqNet
1.8M
2.28
142.00
DIRE
23.5M
4.09
2425.44
UnivFD
85.8M
17.58
63.79
Ours
1.4M
1.73
32.92
Table Comparison different methods on computational cost. compare different models and report the parameters numbers and inference time of each model the same device.
decomposition operation also more efficient than the frequency transform or reconstruction process (like DDIM in DIRE), From Table 7, the inference time (a single forward pass) of our method similar to that of the baseline model without extra operations (around 30 ms). while frequency-base based method FreqNet (142.00 ms) and reconstruction baase DIRE (2425.44 ms) are much slower than ours and the baseline model.
15


Reviews:
[{"review_id": "UEGuuTBIHf", "reviewer": "Reviewer_6H4b", "summary": "This paper proposes a novel framework for detecting AI-generated images (AIGIs) based on pixel-wise image residuals. Residuals are extracted from the quantization error of color space transform and used to train a binary classification model. The results demonstrate promising performance in detecting AIGIs.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank Reviewer 6H4b for the thoughtful and constructive feedback. The response is as follows.\n\n\n> *Q1: Performance on related datasets.* \n \n**A:** Thanks for the advice. We conducted the perturbation experiments on the GenImage dataset (SDv1.4 as an in-domain test set and other models as out-of-domain test sets). After the perturbation of JPEG and Gaussian blur (GB), the results are as follows. The **performance drop (AP) is similar to the baseline model** with normal RGB input, while the **overall results remain higher** than the baseline model. We will test the model on the source identification dataset VISION.\n\n|Pert.|RGB (ID)|Ours (ID)|RGB (OOD)|Ours (OOD)\n|-|-|-|-|-|\n|None|99.93|99.79|76.08|97.53\n|JPEG75|99.97|99.97|75.36|96.83\n|GB(k=7)|99.74|98.11|69.17|92.58\n\n\n> *Q2: Comparison between FFT and DCT.*\n \n**A:** Thanks. Although the DCT part is not the main component in our method, we further ablate the performance with DCT/FFT low/high-frequency components as input on GenImage. The accuracy cannot fully reflect the importance of frequency bands in AIGC detection. From the AP results, high-frequency bands (both DCT and FFT) perform better than low-frequency bands, which meets the results from previous works like FreqNet. However, frequency-based residual inputs seem sensitive to the selection of bands and cannot generalize well on some test sets. Furthermore, JPEG quantizes both high-frequency and low-frequency components in compression to different degrees, and the residual used in the paper is not pure low or high frequencies.\n\n|Model|Acc. (Mean)|AP (Mean)|\n|-|-|-|\n|Baseline|74.03|79.74|\n|FFT-LF|70.25|76.42|\n|FFT-HF|68.96|84.32|\n|DCT-LF|73.50|88.36|\n|DCT-HF|73.89|94.86|\n\n> *Q3: Comparison between computation costs.*\n\n**A:** We compare the computation cost as follows. We only count the parameters and flops of the detector network for all methods with the *fvcore* package. The inference time for a single forward pass includes the time of processing the input. The reconstruction-based method, like DIRE, takes the longest due to the extra generation process. Frequency-based operations like FFT in FreqNet and large pre-trained CLIP models used in UnivFD and C2P-CLIP also hinder the reference speed to different degrees. Our method only adds a little overhead compared with the RGB baseline and is efficient in computation.\n\n|Models|#Params|GFlops|Time (ms)\n|-|-|-|-\n|Baseline|1.4M|1.73|29.13\n|FreqNet|1.8M|2.28|142.00\n|DIRE|23.51M|4.09|2425.44\n|UnivFD|85.8M|17.58|63.79\n|Ours|1.4M|1.73|32.92\n\n\n> *Q4: Baseline explaination.*\n\n**A:** The baseline model is a simple ResNet model used in NPR (smaller than ResNet18). Our method is also based on the same model. We will make it clearer in the new version.\n\n> *Q5: Robustness to adversarial attacks*\n\n**A:** The white-box attack is hard to defend without a specially designed strategy. However, the success defense rate has improved significantly compared with the baseline model. The accuracy of the baseline model drops to 0 under a PGD attack and to 0.43 under an FGSM attack. Our model has an accuracy of 0.51 and 0.46 under PGD and FGSM attacks. The robustness has been largely improved under the PGD attack. A randomly selected model ensemble or training with adversarial samples may further alleviate the risk of attacks.\n\n> *Q6: Other suggestions.*\n\n**A:** Thanks for the kind reminder. We have modified the manuscript accordingly following the suggestions for better presentation.", "claims_and_evidence": "See **Other Strengths And Weaknesses** and **Questions For Authors**.", "methods_and_evaluation_criteria": "The proposed method and evaluation criteria make sense for the problem and application.", "theoretical_claims": "The authors claim that it’s an application-driven machine learning paper. The paper doesn't make strong theoretical claims. It primarily demonstrates its empirical effectiveness.", "experimental_designs_or_analyses": "See **Other Strengths And Weaknesses** and **Questions For Authors**.", "relation_to_broader_scientific_literature": "See **Other Strengths And Weaknesses** and **Questions For Authors**.", "essential_references_not_discussed": "I don't observe any significant omissions of essential references.", "other_strengths_and_weaknesses": "**Strengths：**\n\nS1:\n\nThe paper is well-motivated and easy to follow. The authors develop a novel understanding of quantization error in JPEG-based image compression as key information to detect AI-generated images.\n\nS2:\n\nThe design of PiD is simple yet novel. In contrast to previous frequency-based methods, the PiD has advantages in accuracy.\n\nS3:\n\nCompared to reconstruction-based methods, PiD seems to be more computationally efficient, which makes it possible to be deloyed on a large scale.\n\nS4:\n\nThe experiments are comprehensive and demonstrate the impressive performance of PiD.\n\n**Weakness：**\n\nW1: \n\nThe paper does not discuss the detection performance of compressed images, which may become a key limitation. Images in real-world scenarios, especially on social media, are generally compressed by JPEG (or other image compression algorithms). Since one of the important scenarios for AIGI detection is images from social media, it would be interesting to see whether this method is still effective after the image has been compressed to a certain extent, and lost valuable high-frequency information/color information. I would like to see the method’s performance on related datasets, e.g. VISION dataset [1].\n\nW2: \n\nSection 3.2 discusses the contribution of DCT and CVT in the detection pipeline. The results show that DCT contributes marginally and even reduces accuracy, which needs further discussion. FreqNet [2] uses FFT to train a similar CNN-based classifier and proves the high-frequency component extracted by FFT is also effective. It would be beneficial to perform comparative experiments between FFT and DCT, to better identify the importance of high-frequency components in detecting AI-generated images.\n\nW3:\n\nAlthough it seems that PiD will be faster than many reconstruction-based methods, comparative experiments on computational efficiency are still missing, and the scale of the model is also unknown. Given that existing models generally achieve fairly high accuracy on domain datasets, computational efficiency will become a key metric for new methods. \n\n[1] Shullani, Dasara, et al. \"VISION: a video and image dataset for source identification.\" EURASIP Journal on Information Security 2017.1 (2017): 1-16, https://doi.org/10.1186/s13635-017-0067-2.\n\n[2] Tan, Chuangchuang, et al. \"Frequency-aware deepfake detection: Improving generalizability through frequency space domain learning.\" *Proceedings of the AAAI Conference on Artificial Intelligence*. Vol. 38. No. 5. 2024.", "other_comments_or_suggestions": "S1:\n\nFor the data in Table 1-4, since the improvement of mACC/mAP/mean is already marginal, I suggest highlighting the performance comparison of each individual sub-dataset to facilitate the positioning of the performance on a specific sub-dataset.\n\nS2:\n\nThe legends in Figure 3 overlap with the bars, which affects readability. I suggest repositioning the legend box to prevent this overlap. Additionally, renaming \"w/o CVT error\" and \"w/o DCT error\" to \"DCT only\" and \"CVT only\" would reduce cognitive load for readers.\n\nS3:\n\nFigure reference in line 713 is missing.", "questions_for_authors": "Q1:\n\nIn Table 6, the explanation of the baseline RGB is unclear. The paper does not seem to explain the pipeline of the baseline RGB method. Please consider adding relevant explanations. \n\nQ2:\n\nI am curious if this framework is still robust against adversarial attacks when the pipeline is white-box and known to the public. Since the downstream classification model (ResNet) is widely considered to be vulnerable to adversarial attacks [1], malicious attackers will be able to use gradient methods such as FGSM[1] or PGD[2] to generate human-imperceptible perturbations and add them back to the to AIGI images. It would be good to have some experiments to verify the robustness.\n\n[1] Goodfellow, Ian J., Jonathon Shlens, and Christian Szegedy. \"Explaining and harnessing adversarial examples.\" *arXiv preprint arXiv:1412.6572* (2014).\n\n[2] Madry, Aleksander, et al. \"Towards deep learning models resistant to adversarial attacks.\" *arXiv preprint arXiv:1706.06083* (2017).", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "9x7sr16EF1", "reviewer": "Reviewer_jvUK", "summary": "This paper focuses on Generalized AI-generated image detection via learning low-level signals (residual components) from image compression. To achieve this, the authors map the pixel vector to another color space (e.g., YUV), quantize the vector, and map back to the RGB space. Afterward, the quantization loss is taken as the above low-level signals for training a model to detect AI-generated images. The advantage over the existing works lies in an easily implemented pipeline without introducing cumbersome generative models or Large Language Models.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank Reviewer jvUK for the acknowledgement and constructive feedback. The response is as follows.\n\n> *Q1: Computation efficiency.*\n\n**A:** Thanks for the advice. To prove the computation efficiency of the proposed method, we compute the inference time (single forward pass) and the size of detector networks for different methods as follows. The transformation introduced in our method only adds a little overhead to the baseline cost. Compared with previous methods using reconstruction and frequency operation, the transformation is efficient. The model is also lightweight compared with methods relying on VLM like UnivFD or C2P-CLIP.\n\n|Models|#Params|GFlops|Time (ms)\n|-|-|-|-\n|Baseline|1.4M|1.73|29.13\n|FreqNet|1.8M|2.28|142.00\n|DIRE|23.51M|4.09|2425.44\n|UnivFD|85.8M|17.58|63.79\n|Ours|1.4M|1.73|32.92\n\n> *Q2: Dataset used in Table 6.*\n\n**A:** Thanks. Datasets used in Table 6 are subsets of GenImage, like in Table 5. We will clarify it in the manuscript.\n\n> *Q3: Difference between Image Compression Residuals and Image Reconstruction Residuals.*\n\n**A:** Thanks. The difference between these two concepts is as follows.\n-    Image Reconstruction Residuals used in the paper specifically describe the reconstruction error of generative models used in previous works like DIRE. \n-    The concept of Image Compression Residuals is more general in this paper. The compression operation requires an encoder-decoder structure that is not necessarily a neural network (e.g., JPEG compression or PiD). The bias of the generative model may not appear in Image Compression Residuals. We will clarify the concepts in the manuscript.\n\n> *Q4: Analysis on the transformation.*\n\n**A:** Thanks. We find that the generative model mainly focuses on the content consistency and hypothesize that the overlooked noise information is discriminative in AIGC detection. To verify the hypothesis, we propose the PiD to extract the noise residual during detection.\n\n- *Noise contributes little to the training with original input*. Suppose the image input is $x = u + \\epsilon$ (simplified as vector), considering the simple first linear transformation $f(x) = Wx$ in the network with the loss $L$. The gradient of parameter $W$ can be decomposed into two parts $\\frac{\\partial L}{\\partial f}\\frac{\\partial f}{\\partial W} = \\frac{\\partial L}{\\partial f}x^T = \\frac{\\partial L}{\\partial f}u^T+\\frac{\\partial L}{\\partial f}\\epsilon^T$. Given $|u| \\gg|\\epsilon|$, the gradient is dominated by the main component $u$.\n\n- *PiD filters out the main component while maintaining the noise information.* To verify the effectiveness of the noise part, we subtract the main component $u$ with the transformation and quantization techniques (noted as $T(\\cdot)$). The residual $R(x) = x - T(x) = u + \\epsilon - T(u)$. Given that $T(u) = u + \\epsilon'$, $R(x) = \\epsilon - \\epsilon'$ is a proxy representation of image noise, where $\\epsilon'$ is controlled by the transformation matrix. Taking $R(x)$ as input, the contribution of the noise part can be verified by the experiments.\n\nSince the YUV transform is integrated in the JPEG algorithm, the quantization noise seems a common noise source for real images. And the generative model may also have special noise patterns mixed with other noise sources. By applying the transform and quantization, the main components of images are filtered out, and the noise patterns can be learned.", "claims_and_evidence": "The main intuition starts from how to find a computationally simple and universal forgery artifact without relying on generator-specific cues. However, this work lacks an analysis of why YUV or other transformation matrics are good at discovering these forgery artifacts.", "methods_and_evaluation_criteria": "The authors provide an extensive evaluation of 3 widely used datasets with 26 generative models. The overall evaluation criteria make sense to me.", "theoretical_claims": "No theoretical claims.", "experimental_designs_or_analyses": "It seems that  YUV is the best choice, showing a big advantage over other transformation matrics. Considering this, \na deep theoretical analysis of YUV is best will enhance this paper greatly. Currently, the theoretical contribution is a little weak.", "relation_to_broader_scientific_literature": "Inspired by compression algorithms, the authors reveal that the pixel-wise decomposition residual can benefit AI-generated image detection. However, the theoretical analysis is weak and lacks more discussions.", "essential_references_not_discussed": "No", "other_strengths_and_weaknesses": "Strengths\n1. The overall idea is simple and easy to follow.\n2. The proposed methods do not rely on cumbersome VLM and still achieve SOTA results.\n3. The authors provide an extensive evaluation of 3 widely used datasets with 26 generative models. The overall evaluation criteria make sense to me.\n\nWeaknesses\n1. Lack the inference speed information for the proof of its computational effectiveness.\n2. Lack the theoretical analysis of why the AI-generated images are more likely to fail in the quantization process.\n3. This work lacks an analysis of why YUV or other transformation matrics are good at discovering these forgery artifacts.\n4. The pixel-wise decomposition residual is a well-known concept. A theoretical analysis could strengthen this paper.", "other_comments_or_suggestions": "1. Provide more experiment details of ablation studies.\n2. I don't see much difference between Image Compression Residuals and Image reconstruction Residuals in the existing works. The authors are suggested to add theoretical analysis to distinguish two aspects. \n\nOverall, my current rating is borderline.", "questions_for_authors": "1. In the ablation study, what dataset is used in Table 6? \n2. It seems that  YUV is the best choice, showing a big advantage over other transformation matrics. Considering this, \na deep theoretical analysis of YUV is best will enhance this paper greatly. Currently, the theoretical contribution is a little weak.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "1BlfLNKWYA", "reviewer": "Reviewer_uAyf", "summary": "In this paper, a new discriminant method PID is proposed to detect whether an image is generated by a generative model. This paper explores the impact of noise residual distribution on the discriminant model and believes that the noise space of the image can be represented by color space transformation. By training the transformed residual information, a discriminant model that far exceeds RGB images and does not rely on semantic features can be obtained. The model achieves SOTA level performance and shows good generalization performance.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank Reviewer uAyf for the constructive comments, and the responses are as follows.\n\n> *Q1: Include real image datasets of different distributions.*\n\n**A:** Thanks. The real image distribution is an important factor during testing. The test datasets UniversalFakeDetect and Self-Synthesis used in the experiments are **composed of multi-source test sets.** The test real images are from COCO, ImageNet, LAION, LSUN, CelebA, and FF++, and the training set used from ForenSynths is single-source (only 4-class LSUN images). Therefore, the test setting has met the requirement of diversity. We will make it clearer as in previous work.\n\n> *Q2: More qualitative results.*\n\n**A:** Thanks for the suggestion. We use GradCAM and residual images to illustrate that the model trained with the residual signal **attends to more AIGC artifacts correctly** than the baseline model. The activation of the baseline model falsely appears on the real images with the RGB input. \nWe would like to provide the visualization of different residuals (frequency or reconstruction) on different generative models to compare them in the manuscript or supplementary material.\n\n> *Q3: Performance on GLIDE and BigGAN.*\n\n**A:** Thanks. Although the training method is crucial to the generalization performance, the training data distribution is still important. There might be two main reasons why using GLIDE and BigGAN as the training set harms the generalization. \n- First, the data of GLIDE and BigGAN in GenImage has a **smaller image size** than other classes. The resolution of BigGAN is the smallest ($128\\times 128$) while the resolution of real images is closer to $512\\times 512$. Directly training on them may cause a bias corresponding to the image size. \n- Second, the **image quality** of GLIDE and BigGAN is visually worse than other generative models in GenImage. Images are blurred in GLIDE, and the object is unclear in BigGAN subsets. This causes a large gap in generative artifacts with other models. \n\nThough achieving great generalization performance is difficult in these two training sets, our method largely improves the overall performance and shows an advantage under hard settings.", "claims_and_evidence": "In this paper, the claims are sufficient and supported through empirical experimental results as follows:\n1. The PID method mentioned in the paper uses quantization operation after color space transformation to extract residual noise. The extraction costs little overhead and is efficient to generalize in detection tasks. \n2. The paper claims that the model has strong generalization capabilities and is independent of semantic information. The residual extraction process does not rely on specific generative models and gets rid of the semantic disruption.", "methods_and_evaluation_criteria": "The proposed method utilizes color space transformation and quantization to extract residual image which does not rely on specific generative models and guarantees the generalizability. The proposed method is evaluated on open-source datasets which are widely used in such researches. The accuracy and average precision criteria used in this paper verifies the efficiency of the method.", "theoretical_claims": "In this paper, the core argument is that the residual between the image after color space transformation and the original image contains the noise space information in the image generation process. However, it is not clear enough that the color space transformation can correspond to more complete color space information. This spatial change is beneficial for predicting the noise distribution of the image, but the completeness of using the spatial variation residual to fully represent the noise distribution is still lacking in the paper.", "experimental_designs_or_analyses": "The paper mentions a large number of experiments, including comparative experiments compared with previous methods, test experiments on multiple datasets, and ablation experiments. The overall experimental content is detailed.", "relation_to_broader_scientific_literature": "Current methodologies address this challenge through two complementary lenses: low-level artifact analysis and high-level semantic cues. Low-level methods target severe statistical anomalies caused by the content generation process: CNN-Spot employs data augmentation to improve generalization, while BiHPF amplifies alpha shadows through dual high-pass filters, LGrad implements gradient-based patterns, NPR models pixel relationships, and random mapping features reveal form-specific distortions. In contrast, high-level methods exploit annotation inconsistencies in synthetic content: UnivFD employs CLIP embedding for zero-shot detection, FatFormer combines frequency analysis with language alignment from CLIP, and LASTED utilizes text-guided contrastive learning to identify mismatches between visual and textual semantics, combining low-level artifact detection with high-level semantic reasoning.", "essential_references_not_discussed": "The provided related works are sufficient to understand the key contributions of the paper.", "other_strengths_and_weaknesses": "Strengths:\n1. This article is highly innovative, and it obtains the idea of extracting noise space from the JPEG image compression method. \n2. Compared with other methods, this method has lower computational complexity and provides a new perspective for solving this problem.\n\nWeaknesses:\n1. The variety of real image datasets is lacking when verifying the generalizability of the proposed method. The experiments should include more datasets of different distribution.\n2. There should be more qualitative results showing the differences of residual noise in different datasets. The GradCAM is not sufficient to verify the motivation of the proposed method.\n3. In Figure.7, the evaluation results have a huge drop when training on GLIDE and BigGAN which means that the classifier still has bias on specific generative fingerprints. The causes of such results should be further discussed.", "other_comments_or_suggestions": "No more comments.", "questions_for_authors": "No further questions.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Ejgasu5oJ8", "reviewer": "Reviewer_45ju", "summary": "This paper proposes Pixelwise Decomposition Residuals (PiD) to distinguish real images from synthetic ones. Based on the hypothesis that generative algorithms often overlook low-level signals, the authors decompose synthetic images in the RGB domain. Specifically, they convert images to the YUV color space, apply quantization, revert them back to RGB, and compute residuals. These residuals are then used as input to train a neural network detector. The method claims generalization capabilities across three datasets.", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank Reviewer 45ju for the detailed comments. The responses to the questions are as follows.\n\n> *Q1: Computational efficiency.*\n\n**A:** Thanks. We compare the computation cost of our method and previous methods. The inference time is only slightly slower than the baseline model, while it is **significantly faster** than other residual-based methods or pretraining-based methods like UnivFD.\n\n|Models|#Params|GFlops|Time (ms)\n|-|-|-|-\n|Baseline|1.4M|1.73|29.13\n|FreqNet|1.8M|2.28|142.00\n|DIRE|23.51M|4.09|2425.44\n|UnivFD|85.8M|17.58|63.79\n|Ours|1.4M|1.73|32.92\n\n> *Q2: Questions on the training paradigm.*\n\n**A:** Thanks. We emphasize the generalization capability of methods rather than the training paradigm. Therefore, to have a fair comparison with previous work, we follow the same setting commonly used in AIGC detection (training on seen models and testing on both seen and unseen models). Improvement has been demonstrated in the experiments and meet our claim. \n\n> *Q3: Questions on end-to-end training and networks.*\n\n**A:** Thanks. We clarify the training process as follows. \n- 1) Without guidance, networks are **not guaranteed to** focus on the residual information to classify the data in the training set. The decomposition filters out non-residual information and forces the model to leverage the residual information in classification. \n- 2) Residual input is still in an image form, therefore using a convolutional network to capture the patterns is a natural choice as in previous work like FreqNet/DIRE/NPR. The results fairly reflect the capability of different inputs.\n\n> *Q4: Module settings (image channels, transformation matrix, and quantization).*\n\n**A:** Thanks. We explain the questions on the experiment settings as follows. \n- 1) For grayscale or monochrome images, we *expand* the channels from 1 to 3 to achieve consistent channel numbers during training. \n- 2) A full-rank $3\\times3$ transform matrix is *simple and invertible*. It can map an image forward to a different color space and back to the RGB space to compute the residual information. This is commonly used in color transformation as a basic setting. \n- 3) Rounding and truncation (floor) are two main *basic and standard* quantization operations in signal processing and computation [1]. Using standard quantization functions is computationally efficient and demonstrates the effectiveness of the framework. We would like to clarify these points in the manuscript.\n\n> *Q5: Comparison with camera-specific artifacts.*\n\n**A:** NoisePrint++ is a kind of image representation for image anti-spoofing extracted with networks, **rather than an explicit decomposition** of image information. We compare the NoisePrint++ as input with our method using the same backbone networks. The accuracy (%) results are as follows. On some test sets, it shows improvement on some test sets but the overall generalization is still limited in AIGC detection. The leverage of learnable image representation in AIGC detection requires further study.\n\n|Models|MidJourney|SDv1.4|SDv1.5|ADM|GLIDE|Wukong|VQDM|BigGAN|Avg.\n|-|-|-|-|-|-|-|-|-|-\n|Baseline|67.46|98.68|98.68|55.90|62.80|97.93|49.52|61.62|74.07\n|NoisePrint++|77.18|96.92|96.74|62.10|57.37|92.47|89.61|47.79|77.52\n|Ours|97.16|99.48|99.36|96.34|99.04|98.82|95.76|98.26|98.03\n\n> *Q6: Questions on the benchmarking.*\n\n**A:** Thanks for the suggestion. \n- 1) We intend to compare our method with the best-reported results under the same test setting. Therefore, we cite the higher UnivFD result of 88.8 here. However, the results in DRCT are convincing, and we have reproduced the results of UnivFD with an accuracy of 80.7. This result can be included in the table for future reference. \n- 2) The results of UnivFD are not deliberately chosen in Tables 1 and 2. Since we follow the SOTA results from C2P-CLIP in Tables 1 and 2, some of the reported results of early methods like UnivFD are cited as slightly different from the original paper. We would like to cite the best-reported results under the same setting and check them accordingly.\n\n> *Q7: Suggestions on the reference, writing, and presentation.*\n\n**A:** We have followed your suggestion and modified the manuscript accordingly. The citation is added and discussed in the related works.\n\n> *Q8: Results on Self-Synthesis.*\n\n**A:** Since the results using round are slightly better on GenImage and UniFakeDetect, we use round as the quantization when testing on Self-Synthesis. The results (Acc/AP) of the floor are as follows, and **the performance is still similar**.\n\n|Models|AttGAN|BEGAN|CramerGAN|InfoMaxGAN|MMDGAN|RelGAN|S3GAN|SNGAN|STGAN|Avg.\n|-|-|-|-|-|-|-|-|-|-|-\n|Ours (round)|100.0/100.0|99.9/100.0|95.4/99.7|95.4/99.8|95.4/99.8|100.0/100.0|85.7/96.4|95.4/99.8|85.0/99.5|94.7/99.4\n|Ours (floor)|100.0/100.0|99.9/100.0|97.5/99.4|97.6/99.8|97.6/99.8|100.0/100.0|84.2/91.2|97.6/99.6|97.4/99.9|96.8/98.8\n\n[1] Quantization. IEEE transactions on information theory.", "claims_and_evidence": "- The abstract and Section 1 repeatedly emphasize that existing methods are computationally complex, while the proposed approach is more efficient. However, no comparative or quantitative evaluation of computational complexity is provided in the methodology or experiments. Thus, the claimed contribution of \"a computationally efficient method\" lacks empirical support. \n\n- Similarly, the abstract and Section 1 argue that prior work tends to overfit to generator-specific artifacts, advocating a generator-free design. Yet, the experiments follow the same training paradigm as existing methods by using data from fixed generators (e.g., ProGAN or SDv1.4). This contradicts the claimed novelty of avoiding generator-specific biases.", "methods_and_evaluation_criteria": "Most of the existing reconstruction-based discrimination work requires the introduction of external knowledge (such as DDIM adopted by DIRE), but the author believes that directly \"separating\" a residual noise from the image can achieve detection with strong generalization. My question is:\n- Essentially, these noises also exist in RGB images and are inputted into the neural network for training. So, why can't end-to-end training automatically learn the representation corresponding to these highly generalized noises from RGB images when the loss and final goal are consistent?\n- If this residual noise already has strong discriminability, then simpler networks (such as simple MLP or even a single layer of linear probe) should be used in the future to achieve good discriminability. However, the author did not provide sufficient support in this regard.", "theoretical_claims": "While Figure 3 attempts to justify the use of color conversion for decomposition, critical questions remain unaddressed:  \n- How does the method handle grayscale or monochrome images?  \n- Why is the transformation matrix M_t designed as 3×3? Why are quantization functions (e.g., round or floor) chosen without ablation studies?  \n- Would decomposition based on camera-specific artifacts (e.g., Noiseprint [TIFS’19] or Noiseprint++ [CVPR’23]) yield better results?", "experimental_designs_or_analyses": "- Inconsistent Benchmarking: The results in Tables 1-3 are copied from different existing works, rather than replicated by the authors themselves. There is a serious deviation in the results caused by inconsistent raw test data. For example, the original papers of DRCT and C2P-CRIP both tested the results of UnivFD on the GenImage dataset, which showed an average Acc of 79.45 and 88.8, respectively. However, the authors clearly copied the results of the latter (C2P-CRIP) directly and entered them into Table 3. So, why not copy the results of DRCT?\n\n- Cherry-Picked Variants: Many existing works have different variants, for example, CNNSpot has two data augmentation versions with probabilities of 0.1 and 0.5, while UnivFD has two implementation methods based on Nearest Neighbor and Linear Probe. However, the authors are very **tricky**. Table 2 only shows the results of its poor variants for UnivFD. For example, the AP of UnivFD in DALLE detection in Table 2 is 88.45, while the original result of UnivFD shows that it can achieve an AP of 97.15 on DALLE in the variant of Linear Probe.", "relation_to_broader_scientific_literature": "NA", "essential_references_not_discussed": "D. Cozzolino, et al. \"Zero-Shot Detection of AI-Generated Images\", in ECCV'24.", "other_strengths_and_weaknesses": "NA", "other_comments_or_suggestions": "Line 184: Replace \"M\\_high\" with \"M\\_{high}\" for proper LaTeX formatting.  \nAvoid using \"raw\" to describe original RGB images, as it may confuse readers with the RAW image format.", "questions_for_authors": "Why is there only one variant of PiD proposed in Table 4, instead of two as shown in Tables 1-3?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethical_review_concerns": "NA"}}, {"review_id": "yMA19MD1S8", "reviewer": "Reviewer_4ooD", "summary": "In this paper, the authors propose extracting the “residual” of images to detect AIGC images. Specifically, the residual refers to artifacts introduced at the low-level visual features due to the generative model’s excessive focus on semantic content during the image generation process. These artifacts serve as distinguishing cues between AI-generated and real images. Extensive experiments demonstrate the effectiveness of this approach.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank Reviewer 4ooD for the thoughtful comments. The responses to the questions are as follows.\n\n> *Q1: Why do these residuals inherently capture the artifacts?*\n\n**A:** Thanks. \n- Generally, the residual for an image input $x$ has the form $R(x) = x - \\Phi(x)$ as described in the paper. Ideally, $ \\Phi(x)$ represents the information that contributes most to the visual quality. \n- The training of generative models mainly focuses on content consistency, while the noise information is not well-modeled (as shown in Eq. 3). This information does not affect the overall visual quality of images, but can also reflect the difference between real and fake images. \n- Differences in high-frequency residual distribution are observed in [1]. While the distribution of other residuals cannot be well visualized, the test results demonstrate that residuals like DIRE or the proposed PiD also exhibit discrimination capability in AIGC detection.\n\n> *Q2: Other residual processing methods.*\n\n**A:** Some methods in previous work can also be classified as residual-based methods like high-frequency components (DCT/DWT/FFT) or reconstruction error (diffusion models). An encoder-decoder structure exists in these methods. However, learnable structures may be avoided to alleviate the bias in the residual signals. A simple operation that filters the content information shows advantages in generalization, as the proposed method.\n\n> *Q3: Results on facial synthesis datasets.*\n\n**A:** Thanks. The generalization of different source images is important. Some test sets in experiments are facial synthesis datasets, in which both real and fake images are faces, like AttGAN, STGAN, and Deepfakes. Our method can generalize well on these facial synthesis datasets at testing. To further explore the capability of the proposed method, we also test our method on high-quality facial synthesis data generated from HeyGEN (VFHQ as the real dataset), the accuracy is 86.95\\% (much higher than the baseline 62.88\\%), which shows the potential in broader application.\n\n[1] Frank J, Eisenhofer T, Schönherr L, et al. Leveraging frequency analysis for deep fake image recognition[C]//International conference on machine learning. PMLR, 2020: 3247-3258.", "claims_and_evidence": "[+] Using image residuals as evidence for detection is clear and well-supported.\n\n[-] However, what exactly the “residual” represents in an image, why it can be easily extracted in the YUV color space, what kind of information previous residual extraction methods have captured, and how the residual in this work differs from them all remain unproven.", "methods_and_evaluation_criteria": "The proposed method, its implementation, and the chosen baselines are comprehensive. However, the authors are encouraged to include additional datasets, such as traditional face-swapping datasets, to investigate whether the extracted residuals remain effective for facial images.", "theoretical_claims": "The reviewer has checked the definition of the noise-aware residual representation R(x), and confirmed its feasibility for AIGC detection.", "experimental_designs_or_analyses": "The experimental results demonstrate the effectiveness of the proposed model. However, it is recommended that the authors extend their method to facial synthesis datasets rather than focusing solely on general scene datasets.", "relation_to_broader_scientific_literature": "The proposed method may offer insights for generalized deepfake detection by further exploring the distinctions between real and fake images.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "[-] The primary concern of the reviewers remains the precise definition of “residuals.” Why do these residuals inherently capture the artifacts unavoidably introduced during the generation process? What fundamental theoretical differences exist between residuals in real and fake images? \n\n[-] Are there alternative residual processing methods beyond JPEG compression and the YUV color space? Is residual extraction possible for any model with an encoder-decoder structure? How can we ensure that these methods do not introduce additional biases, as seen in DIRE?", "other_comments_or_suggestions": "A more thorough theoretical analysis of residuals is necessary, and additional experiments are also encouraged to further validate the approach.", "questions_for_authors": "Please see weaknesses.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The submission received one reject, one weak reject, and three weak accepts. The authors provided detailed responses, which, while not overturning the negative rating, convinced the Area Chair that the submission's strengths and contributions outweigh its weaknesses.

----
### Summary of the paper:
 
This paper proposes PiD, a novel and lightweight method for AI-generated image detection based on pixelwise decomposition residuals. The core insight is that generative models primarily optimize semantic content while neglecting fine-grained noise components—what the authors refer to as "residuals". The method involves mapping images to an alternative color space (e.g., YUV), quantizing the pixel vectors, reconstructing back to RGB, and using the resulting residuals to train a downstream binary classifier.

### Strengths:

1. Novelty in Residual Extraction:

The idea of extracting quantization-induced residuals after color space transformation is novel and computationally simple. It sidesteps the need for reconstruction from generative models (e.g., as done in DIRE) or heavy semantic embeddings (e.g., CLIP in UnivFD).

2. Strong Empirical Results:

Across three major benchmarks (GenImage, UniFakeDetect, and Self-Synthesis), the method achieves competitive or superior results in accuracy and AP, particularly in generalization across unseen generative models, which is a known challenge in AIGC detection.

3. Computational Efficiency:

The method uses a lightweight ResNet variant and introduces only marginal overhead compared to RGB baselines (e.g., \~32.9 ms per image vs. 29.1 ms), while being much faster than methods like DIRE (\~2.4s) or CLIP-based approaches. This is backed by FLOPs and parameter count comparisons.

4. Detailed Rebuttal:

The authors provided a strong and thoughtful rebuttal, including:

- JPEG robustness experiments.
- FFT vs. DCT ablation.
- Efficiency benchmarks.
- Robustness to adversarial attacks.
- Clarification on YUV rationale and residual extraction theory.

### Weaknesses:

1. Theoretical Underpinning Could Be Stronger:

Several reviewers (jvUK, 4ooD, 45ju) noted that the motivation and formal justification for why residuals extracted in YUV (or any color space) are more effective than other low-level signals could be deepened. The rebuttal partially addressed this, but the paper still lacks a rigorous theoretical treatment.

2. Benchmarking Inconsistencies Raised:

Reviewer 45ju highlighted issues with cherry-picked baseline numbers (e.g., reporting weaker UnivFD variants), and use of results across papers without re-implementation under consistent settings. While the authors explain their rationale, this does slightly reduce trust in the experimental comparison.

3. Residual Conceptual Ambiguity:

The term "residual" in this context overlaps with prior work (e.g., DIRE, FreqNet, NoisePrint++), and some reviewers felt the distinction wasn't clearly defined. The rebuttal helps delineate compression residuals vs. reconstruction residuals, but more emphasis could be placed on how PiD's residuals differ in signal characteristics and generalization behavior.

4. Reviewer Conduct Concerns:

Reviewer 45ju’s tone and accusations (e.g., describing authors as “tricky”) are unprofessional and inconsistent with ICML review standards. Despite some valid points in the critique, such language undermines the review’s objectivity.


### Rationale for final rating:

Despite some remaining concerns about theoretical grounding and benchmarking rigor, I find the overall contribution of this paper to be solidly positive, especially in terms of practical impact, generalizability, and computational efficiency. The approach is original and potentially impactful in real-world deployments of AIGC detectors, particularly under resource constraints. The authors also demonstrated scientific diligence in addressing nearly all reviewer concerns in a transparent and responsive manner.

Therefore, I recommend a weak accept, particularly if space permits. A strengthened revision could be encouraged to include:

- A more detailed theoretical analysis of the residual mechanism.
- A clarified comparison with prior "residual"-based methods.
- Ensuring reproducibility with code and consistent benchmarking.

best,
AC
Decision: Accept (poster)