STD-FD: Spatio-Temporal Distribution Fitting Deviation for AIGC Forgery Identification
Authors: Hengrui Lou
Zunlei Feng
Jinsong Geng
Erteng Liu
Jie Lei
Lechao Cheng
Jie Song
Mingli Song
Yijun Bei
Venue: ICML 2025 poster (2025)
Keywords: Deepfakes
Forgery Detection
AIGC
Diffusion
Primary area: social_aspects->safety
TL;DR: This paper presents a new technique for fake image detection in AIGC era

Abstract: With the rise of AIGC technologies, particularly diffusion models, highly realistic fake images that can deceive human visual perception has become feasible. Consequently, various forgery detection methods have emerged. However, existing methods treat the generation process of fake images as either a black-box or an auxiliary tool, offering limited insights into its underlying mechanisms. In this paper, we propose Spatio-Temporal Distribution Fitting Deviation (STD-FD) for AIGC forgery detection, which explores the generative process in detail. By decomposing and reconstructing data within generative diffusion models, initial experiments reveal temporal distribution fitting deviations during the image reconstruction process. These deviations are captured through reconstruction noise maps for each spatial semantic unit, derived via a super-resolution algorithm. Critical discriminative patterns, termed DFactors, are identified through statistical modeling of these deviations. Extensive experiments show that STD-FD effectively captures distribution patterns in AIGC-generated data, demonstrating strong robustness and generalizability while outperforming state-of-the-art (SOTA) methods on major datasets. The source code is available at [this link](https://github.com/HengruiLou/STDFD).

STD-FD: Spatio-Temporal Distribution Fitting Deviation for AIGC Forgery Identification
Hengrui Lou't
Zunlei Feng 12
Jinsong Geng"
Erteng Liu' Jie Lei Lechao Cheng
Jie Song' 12
Mingli Song 15 Yijun Bei x2
Abstract
1. Introduction
With the rapid development of AIGC technologies (Cao et al., 2023), substantial advancements have been made in abstract concept and content generation. However, AIGC also presents significant risks. While it revolutionizes pro- duction methods and transforms industries such as media, entertainment, e-commerce, and education, it also intro- duces major security concerns, particularly in image forgery, Previous studies (Zhao et al., 2023) have highlighted that malicious actors can exploit AIGC to forge and manipu- late images, making it increasingly difficult to verify the authenticity of generated content. This undermines trust in multimedia information and poses serious societal threats, including financial fraud, misinformation, and identity theft.
With the rise of AIGC technologies, particularly diffusion models, highly realistic fake images that can deceive human visual perception has become feasible. Consequently, various forgery detection methods have emerged. However, existing meth- ods treat the generation process of fake images as either a black-box or an auxiliary tool, offering limited insights into its underlying mechanisms. In this paper, we propose tribution Fitting Deviation (STD-FD) for AIGC forgery detection, which explores the generative process in detail. By decomposing and recon- structing data within generative diffusion models, initial experiments reveal temporal distribution fitting deviations during the image reconstruction process. These deviations are captured through reconstruction noise maps for each spatial seman- tic unit, derived via super-resolution algorithm. Critical discriminative patterns, termed DFactors, are identified through statistical modeling of these deviations. Extensive experiments show that STD- FD effectively captures distribution patterns in AIGC- AIGC-generated data, demonstrating strong ro- bustness and generalizability while outperform- ing state-of-the-art (SOTA) methods on major datasets. The source code is available at this link.
Dis-
The rapid advancement of AIGC generation technologies has made effective forgery detection of new types of AIGC- generated images urgent challenge. Unlike traditional forgery methods, which involve region manipulation, edit- ing, or recreation, AIGC employs novel generative frame- works, such as diffusion models. This shift renders con- ventional forgery detection techniques, which are primar- ily designed for GANebased tasks, ineffective for identify- ing forgery in fnfffusion-generatee images. In response these challenges, recent studies have focused designing deepfake detection models specifically targeting diffusion- generated images. These approaches (Sha et al., 2023; Corvi et al., 2023b; Wang et al., 2023; Chen et al., 2024) primarily rely on reconstruction errors between real and fake images, treating reconstruction as an end-to-end tool for identifi- cation. However, this strategy is highly sensitive to the reconstruction model itself, with its properties significantly influencing forgery detection performance. For instance, reconstruction model pre-trained on animal images may pro- duce larger errors when applied to plant images, misclassify- ing real plant images as fake. Furthermore, reconstruction- based methods often treat the diffusion model's generative process as black-box, limiting their ability to capture the deeper mechanisms underlying fake image generation. By focusing solely reconstruction errors, these methods fail to fully analyze the generative process, reducing their effec- tiveness in detecting modern AIGC content.
Corresponding author. 'State Key Laboratory of Blockchain and Data Security, Zhejiang University "School of Software Technology, Zhejiang University 'College of Computer Sci- ence, Zhejiang University of Technology "School of Com- puter Science and Information Engineering, Hefei University of Technology Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security. Correspondence to: Yijun Bei <beiyj@ zjw.edu.c>>.
Proceedings of the 42nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

STD-FD: Spatio-Temporal Distribution Fitting Deviation for AIGC Forgery Identification
To address these limitations, we propose novel approach based on analyzing the distribution fitting of forged data through the lens of generative diffusion models, which in- volves stepwise decomposition and reconstruction. Specif- ically, to effectively capture the differences in distribution fitting across different semantic modules, we first employ a superpixel algorithm to partition the image into minimal units based on color and positional features from a 2D spatial perspective. Next, a generative diffusion model is adopted to obtain the distribution of stepwise decomposition and reconstruction for each semantic unit. We then model the distribution fitting deviation for each semantic unit to extract fitting differences. Finally, these distribution fitting deviations are aggregated to construct forgery identification features, which achieve state-of-the-arr performance using simple classifier. Our key contributions are as follows:
of prominent models such as Stable Diffusion (SD) (Stabil- ity.ai, 2023) and Midjournyy (Midjourney, 2022).
2.2. Image Forgery Identification
Initially, researchers focused on identifying clues for detect- ing forged images in the spatial domain, such as color (Mc- Closkey & Albright, 2018), saturation (McCloskey & Al- bright, 2019), and blended boundaries (Li et al., 2020). How- ever, as image generation technologies advanced, it became increasingly difficult to construct reliable hand-crafted fea- tures in the spatial domain. Additionally, images often un- dergo multiple rounds of compression during transmission across various streaming platforms, resulting in low-quality images that obscure forgery artifacts. To address these chal- lenges, researchers shifted towards exploring the frequency domain for discriminative clues, leading to methods based on different frequency bands (Li et al., 2021), scales (Wang et al., 2022), and adaptive frequency feature extraction (Qian et al., 2020a). While frequency-donee strate strong forgery detection performance in highly com- pressed images, their effectiveness significantly decreases when confronted with unknown forgery techniques.
We present spatio-temport distribution fitting frame- work that extracts temporal change patterns of each semantic block for AIGC forgery identification, offer- ing a novel perspective on distribution fitting deviations for future deepfake research.
methods demon-
Building on the underlying decomposition and recon- struction mechanisms of the diffusion process, discrim- inant change patterns DFactor is devised to extract fitting deviations of spatio-temporal distribution for AIGC forgery identification.
Most of the aforementioned works were designed for GAN- generated images. Although researchers (Corvi et al., 2023a; Ricker et al., 2022) identified that spectral artifacts can arise in diffusion- ing fake images remains limited. To address this, researchers are increasingly moving away from traditional clues used for -eAN-generated images and are seeking unique indica- tors derived from the diffusion generation process itself. For instance, DIRE (Wang et al., 2023) and ScDIE (Ma et al., 2023) leveraged reconstruction errors from diffusion models to detect fake diffusion diffussiongenerrteed images. Building on this, LaRE2 (Luo et al., 2024) and AEROBLADE (Ricker et al., 2024) focused on reconstruction errors in the latent space for detection. DRCT (Chen et al., 2024) employed recon- struction results from both real and fake images, training a classifier using contrastive learning loss.
images, their effectiveness in detect-
Extensive experiments demonstrate that the proposed STD-FD achieves state-of-the-an performance in forgery identification task and significantly improves generalization capability in real-world scenarios.
2. Related Works
2.1. Forgery Technology
GAN-based and autoregressive models were pioneers in the field of image generation, with notable products such as BigGAN (Brock al., 2018) and DALL-E (Open AI, 2023) emerging during their development. However, limitations in their control over generated content, along with stability and complexity issues, paved the way for new image genera- tion paradigm: diffusion models. Denoising Diffusion Prob- abilistic Models (DDPM) (Ho et al., 2020) demonstrated promising generative quality, sparking a series of studies on diffusion models. Subsequent research focused on en- hancing structural design and improving sampling efficiency. Later, the Latent Diffusion Model (LDM) (Rombach al., 2021) applied the diffusion process in latent space, signifi- cantly improving diffusion model efficiency and introducing lext-conditionin capabilities through cross-attention mech- anisms. LDM has since become a key driver in advancing image generation technology, leading to the development
However, these methods primarily rely on reconstruction errors, which makes them highly susceptible to the influ- ence of the pre-trained reconstruction model. If the training domain of the reconstruction model differs from the detec- tion domain (e.g., training on cat images but applying it to detect forged images of dogs or even houses), real im- ages may be misclassified as fake. The root cause of this issue lies in treating reconstruction results as mere metrics and using the diffusion reconstruction process only as an auxiliary tool, without fully analyzing the underlying diffu- sion mechanisms. This oversight prevents a comprehensive understanding of the generative principles behind fake data.
2

---

STD-FD: Spatio-Tempore Distribution Fitting Deviation for AIGC Forgery Identification
3. Preliminaries
The final sampling formula (corresponding to Equation (12)
in the DDIM paper) is obtained follows:
In this section, we first define the key notations of the diffu- sion model and outline its fundamental principles. Building on this foundation, we then introduce the entry points of the proposed STD-FD method, which delves into the underlying mechanisms of the diffusion process.
(t) C (Iz)
It
Tt-1 var-1
Oit
3.1. Notations
"predicted mo""
+ 01-1 - of 6 (10)
In this section, we utilize the standard notations defined by DDPM (Ho et al., 2020). The true data distribution is represented g(vo), while the latent variable model approximates it po (2o). The noise-prediction model, co. is parameterized by weights 0.
"direction pointing to xx²"
where or is set 0 to achieve deterministic sampling process, and thus the random noise term ofc, is removed.
The diffusion model comprises T-step diffusion process (( (1) and a demoising process po (x( for < t S T. which is defined as follows:
From Eq. (7), we observe that for any timestep 2t-1 during the sampling process, 0,-1 is the known noise factor deter- mined by the scheduling scheme. The unknown parameters are "predicted xo" and "direction pointing to xz," Further, both parameters are derived from the same variable ef" (zx). Therefore, the changes in the data and distribution during the diffusion model's sampling process are driven by noise Eg (1) (zz). As result, STD-FD constructs the key represen- tations of distributional variations by capturing distributed noise 6g (xxx)) each timestep of the sampling process.
((xa)rr-1) = (112 V B, BeT),
(=( = N (1 1), (x t)),
(2)
where 2, refers to the diffusion result at timestep i, Be is the noise factor at timestep f, I,1i is the identity matrix, /V represents the normal distribution, indicating that the data probabilities during both noise addition and denoising fol- low a normal distribution. H4g and Σg are the mean and variance matrix of the denoising distribution respectively. The forward sampling at time step É is given follows:
4. Methodology
(<)|/Zo) = NNx;; Vāzzo, (1 11-ap a)
(3)
In this section, we first outline the extraction of spatio- temporal distribution change patterns and the construction of global discriminative factors. Next, the discrepancy de- tection module is devised identify spatio-temporal distri- bution fitting deviation for forged image identification.
where 0g = 1-11-- 3r and a; = I Oss- a, denotes the noise weighting coefficient at each diffusion timestep, controlling the intensity of the noise added each step.
3.2. Definitions
4.1. Spatio- Distribution Change Extraction
In this section, we follow the sampling process from DDIM (Song et al., 2021) and explore the key aspects based on distribution variations starting from the deterministic sampling function itself.
Noise Reshaping. As mentioned in the preliminaries, construct key representations that capture the changes throughout the entire diffusion sampling process by tracking distributed noise cg (are) at each timestep. <g" (az) repre- sents the noise added Ty at each timestep, with shape of (C, H, W). To facilitate the subsequent capture of spatial and temporal information during the sampling process, we convert e( (zx) to image format, as shown in the following:
The deterministic sampling function recovers original data from noised input zo at timestep i, which is defined as:
Vanzo + vI -0rt (t) (are),
(4)
where <g (x)) is the noise predicted by the network at timestep I.
In combination with the following equation:
c (4) (x,) min(e (4) (x,)) x 255, (t)
Norm(e (0) (x)))
Ft
O1e (art
max(e, (xt) - min(e (1)
9 (xt)
(5)
(8)
vaz
where Norm(-) performs the normalization and converts the data into an image with values in the range [0, 255].
of
Pt-1 00-1000
0.-1
(xt
ta
at
Spatial Information Capture To capture the spatial in- formation of the noise itself during the sampling process,
(6)
3

---

STD-FD: Distribution Fitting Deviation for AIGC Forgery Identification
X
X1
Xy
Xt
X
X
(8))
(
Ey (12)
oy (x))
Block
SSIM
change.
Black A:
Superpizel
Block
Spatial Temporal Information Capture
Block (TNNl WTTW tn
DFactor
Comparing Block and DFactor & 4 =idinda a conte, II
Module
Block A: M. TTTT NTT
DFactor
!
Block "VN I LIMH
C₁:
DFuctor K:
(b) Distribution Chunge Patlern Extraction
Candidates
(c) Diserepancy Defection
Figure 1. Framework of the proposed STD-FD, which is composed of two stages: spatial-temporal information capture (a & b) and discrepancy detection via distribution fitting deviation (c). In the first stage, temporal change information for each semantic block, corresponding the spatial superpixel, is firstly extracted (a). Then, focus on extracting the DFactor, which can distinguish between positive and negative samples during the sampling process. Next, global classification discriminative factors Daactor are constructed by identifying key changing segments that differentiate hetween the two types of samples (b). Finally, based on the D) Factor extracted from the first stage, we perform distribution fitting deviation modeling on the data to be identified. Feature engincering is completed using distance, correlation, and matching metrics (c). With the extracted feature Ac. classifier trained for forgery identification.
we employ the SLIC (Achanta et al., 2012) superpixel to segment the image into minimal units based on color and spatial features from a two-dimensional perspective of the noise:
anomalies certain time segments during the sampling pro- cess. Our current goal to find such "anomalies" serve as the basis for distinguishing positive and negative samples
(Let's call it the Discriminant Factor, D Factor)). Therefore, we have designed algorithm to capture DF from the time-series data that are crucial for classification.
gNNorm (x))) {S1, , Sk].
(9)
where g() denotes the application of the SLIC superpixel segmentation on the input image, and the image divided into K segments.
Specifically, H₃ is the set of time-series information of noise distribution changes for the k-th block across all samples (including positive and negative samples), with the corre- sponding label set Yx. We need to generate a candidate set of DFactor Ck (the specific steps for constructing the candidate set will be detailed in Section 4.2). For Cs. we first compute the weighted distance between each candidate F actor and the time series, then perform a weighted sum of all distances to obtain the total distance of the time series. We use GDTW (Greedy Dynamic Time Warping) to mea- sure the distance; GDTW retains the nonlinear alignment characteristics of DTW while employing greedy strategy to improve computational efficiency, making it suitable for handling long
Temporal Information Capture. We capture the temporal information of eo (are) distribution changes from the dif- fusion sampling process. For a sampling process with T timesteps, block Sg contains intermediate sampling results over T steps, i.e., [S,, , J. We record the tempo- ral variation of the (1) (x+) by calculating the SSIM (Wang et al., 2004) between adjacent timesteps.
hR = (hh NE...., 11 11-1),, A4 = SSIM St S(+1), (10)
data. The formula for calculating the weighted distance between each candidate D Faclor and the time series is as follows:
where ht represents the temporal variation sequence of (4)
Eg (zz) for the k-th image block, with sequence length of T - 1, where & E {1, 2,., K}. SSIM(S, s(+1) denotes the Structural Similarity calculated between St and st+1
d(Ca, Σ (Cgathi)) | (path()) )² (11)
Extraction of Distribution Change Patterns. After cap- turing the spatial and temporal information, for an image to be analyzed, we can obtain [hy fq..... . .y...., hg]. Each he represents the quantified time-series information of the noise distribution changes in the k-th block.
where J is the length of the alignment path obtained by the greedy algorithm. Cgath(i)) and goath()) are the j-th matched DF and time-series segment according to the greedy alignment path, respectively. Wheall is the local timing fac- tor within the D) Factor, adjusting the importance of each position within the D Factor.
We now need to extract the distribution change patterns from each block. During the diffusion sampling process, there exists a temporal deviation in distribution modeling be- tween real and fake samples. This deviation is manifested as
Next, we perform a weighted sum of all distances to obtain the total distance of the time series:

---

STD-FD: Spatio-Tempore Distribution Fitting Deviation for AIGC Forgery Identification
Identification Feature Construction. After obtaining the candidate discriminative factors for each block of the sam- ple to be tested, we construct features by comparing the candidate discriminative factors of each block with the best discriminative factors of the corresponding block. Specif- ically, for the candidate discriminative factors {(x} of the k-th block of the sample and the discriminative factors {D [actorr of the k-th block, we construct features {A*} based on distance, matching degree, and correlation. Then, we concatenate the features { from the K blocks to form the forgery discrimination features of the data.
M
P(1) Σ Softmax (-d (C% 1) |Ugghoall) l)
(12)
(d (CE, ()) |[Ughobal))
where M is the total number of candidates Cg Wglobal is the global factor, adjusting the importance of different CX" Softmax assigns higher probabilities to larger values. By applying a negative sign, candidate factors closer to the current temporal data are given greater weight.
Specifically, for each block & (k = 1.2...., K), we have the candidate discriminative factor G₁ of the sample, and the discriminative factor DFactorg obtained from training. Based on the distance, matching degree, and correlation between C₁ and DFactork, we compute the feature vector A as follows:
At this point, we have obtained the distance between each candidate DFactor and the time series (including both pos- itive and negative samples). We construct a loss function using KL divergence, and by minimizing the loss via gradi- ent descent (maximizing the distance between positive and negative samples), we achieve the extraction of the optimal discriminative factors. The defined loss function is:
A = [dist(ck; ak), match(ca, ak), corr(ck, ax)], (15)
Where dist(ck; o*), match(Ck, ax). and corr(ck, a&) repre- sent the distance, matching degree, and correlation between Ck and ags respectively.
N KL OV +X
L =
Σ ==1
(13)
Then, we concatenate the feature vectors A& of all K blocks to form the forgery discrimination feature vector A:
X a Wiocal lpp + |||| Wgloballpp.
(14)
where x represents the sum of the local and global factors. 14,00 4. and , o_ are the mean and standard deviation of distances between positive and negative classes. Wiocal and W Wilobal the local and global temporal factors, respectively. and 3 are regularization coefficients. p is the norm degree.
A [Ai, A2,
Ak]-
(16)
Using the above feature vector A, a forgery identification classifier is trained. During the testing phase, the feature vector of the test image is input into the classifier for forgery identification.
4.2. Discrepancy Detection via Distribution Fitting Deviation
5. Experiments
Candidate Discriminative Factors Generation. In Sec- tion 4.2, we obtained the discriminative factors DF Factork that can distinguish between positive and negative samples. We perform forgery identification based on the fitting devi- ation between the data to be tested and the discriminative factors. Specifically, we process the sample to be tested in the same way as in Section 4.1 to obtain [h,, /2,..................... hx)-
In this section, we present detailed evaluation of the per- formance of STD-FD across three parts. Specifically, we first provide comprehensive experimental settings. Next, we compare the performance of STD-FD with detection methods, including SOTA approaches, on multiple datasets. Then, we conduct experimental analyses of the generaliza- tion performance of STD-FD.
First, for each time series hg. we extract all subsequences of length L to form the set SCO, and compute the initial distance score x of each subsequence relative to the mean subsequence sč0g. Then, we merge all subsequences and corresponding distance scores into a global set SCO.
5.1. Experimental Setup
Datasets and Evaluation Metries. We evaluate the pro- posed method using the GenImage (Zhu et al., 2023) and Deepfacegen (Bei et al., 2024) datasets. GenImage com- prises 1,331,167 real images and 1,350,000 generated im- ages. The generated images are sourced from 8 different generative model. In our research, we follow the official dataset split, allocating 2,581,167 images for training and re- serving the remaining 100,000 images for validation. Deep- FaceGin is a facial forgery dataset that includes both video
In the greedy algorithm, we iteratively select the subse- quence sco" with the highest distance score from SCO, add it to the candidate set C, and update the distance scores (ssco) of the remaining subsequences to encourage diver- sity among candidates. We repeat this process until we obtain M candidate Factorr The final set C contains candidate Factorr, for subsequent analysis.
5

---

STD-FD: Spatio-Temport Distribution Fitting Deviation for AIGC Forgery Identification
Weasin
ALC%
S.v
AB0C%
SDJ
DALLES
100
ADM
SDv14
SDXLR
DALLE
90
20
0J
MJ
85
GLIDE
MI
CNNSpp
PANt
CLIPARNO
pixzpix
DF-GAN
Xecptnn
Uni-DD
EdficientNee
DIRE
DNADet
FJNee
GramNer
Swin-T
UaivD
De-fake
Chav-B
DIRE
Frog Net
NPR
DRCT
Wakong
BigGAN
PaichCraft
SD2
SBAL
VD
RECCE
STD-FD
(Ours)
VQDM
STD-FD
Figure 2. Performance comparisons on Deepfacegen (AUC, %). The radar chart on the left illustrates the detection performance of STD-FD compared to other methods, with solid lines representing the comparison methods and dashed line representing STD-FD. The bar chart on the right presents the average AUC across 12 subsets for each method, where solid-edged bars indicate the com- parison methods, and dashed-edged hars represent STD-FD.
Figure 3. Performance comparisons on Genimage (ACC, %). The radar chart on the left illustrates the detection performance of STD- FD compared to 12 other methods, with solid lines representing the comparison methods and a dashed line representing STD-FD. The bar chart the right presents the average ACC across subsets for each method, where solid-edged bars indicate the comparison methods, and dashed-edged bars represent STD-FD.
and image modalities. We selected facial forgery data gen- erated using novel prompt-guided forgery methods. These methods encompass a total of 12 approaches based on both diffusion and autoregressive models, using either text-to- image or image-to-image modalities. Consistent with the evaluation metrics established in the benchmark paper, we adopt Accuracy (ACC) and Area Under the Curve (AUC) as our performance measures.
subsets. Notably, the improvement was most significant in the subsets where distinguishing between real and fake im- ages was particularly challenging, such as those generated by DALL-E 1, DALL-E 3, Midjoumey, and Wenxin.
Overall, STD-FD achieved AUC exceeding 90% across all subcategories of forged data, with an average AUC of 94. 94.90% (detailed results are in Table in the Appendix).
Genimage Benchmark. To further validate the effective- ness of STD-FD, conducted comparisons following the same experimental protocol as Genlmage. We compared our method with 12 forgery detection models, including CNNSpot (Wang et al., 2020). F3Net (Qian et al., 2020b),
Implementation Details. XGBoost (Chen & Guestrin, 2016) is employed as the classifier. In the identification feature construction phase, Euclidean distance and Dynamic Time Warping (DTW) are adopted to measure the similarity between the candidate discriminative factors and the optimal discriminative factors. For match rate-based methods, trend match rate (using sign matching) is applied, while Pearson correlation and template matching (NCC) are employed for correlation -based methods. The experiments are conducted on two GeForee RTX 4090 GPU (24GB VRAM).
CLIP/RN50 (Radford et al., 2021), GramNet (Liu et al., 2020), De-fake (Sha al., 2023), Conv-B (Liu et al., 2022), Swin-T (Liu al., 2021), UnivED (Ojha et al., 2023),
DIRE (Wang et al., 2023), PathCraft (Zhong al., 2023), AIDE (Yan et al., 2024), and DRCT (Chen et al., 2024). All identification methods were trained on the SDv 1Dv1.4 1.4 subset of GenImage. Specifically, STD-FD and the comparison methods were trained on SDv1.4 and evaluated on differ- ent testing subsets. This benchmark poses a significant challenge, as the overall accuracy is closely tied to the cross- generator generalization ability of the identification methods. The comparative results in Figure 3 show that all methods achieve very high identification accuracies on the SDv 1.4 SDv1.5, and Wukong subsets. However, a noticeable drop in accuracy (ACC) can be observed across other subsets such as Midjourney, ADM, GLIDE, VQDM, and BigGAN, par- ticularly for aondiiffusion-based generators like BigGAN. In contrast, STD-FD demonstrated superior performance these challenging subsets. Even BigGAN, which is based on GAN architectures, STD-FD achieved the best results. This can be attributed to the DFactor extraction pro- cess of STD-FD, which spans both the temporal and spatial domains, enabling excellent generalization performance by distinguishing between positive and negative samples.
5.2. Comparison with SOTAS
Deepfacegen Benchmark. In this section, we compare our method with several mainstream and sfate-of-the-arn gener- ated image detection methods, including Xception (Chollet, 2017), EfficientNet-BO (Tan & Le, 2020), F3-Net (Qian et al., 2020b), RECCE (Cao et al., 2022), DNADet (Yang et al., 2022), DIRE (Wang et al.. 2023). DRCT (Chen et al., 2024), UnivFD (Ojha et al., 2023), NPR (Tan et al., 2024a), and FreqNet (Tan et al., 2024b). Following the evaluation protocol of DeepFaceGen, our proposed method, STD-FD, was trained and tested in the same manner as the compar- ison methods on both real data and data generated by 12 different forgery methods, including DALLEE (Open AI, 2023) and SD (Stable Diffuusion) aii,, 2023). The dataset was split into training, validation, and test sets in a ratio of 7:1:2. The results, shown in Figure 2, indicate that STD-FD achieved the best performance across all 12
6

---

STD-FD: Spatio-Tempora Distribution Fitting Deviation for AIGC Forgery Identification
Table 1. Generalization Performance Comparison on Genimage Subsets with Mainstream and SOTA Methods. Fach value represents (Scorel/ / Score2), where Scorel denotes the ACC trained and tested on the current subset, and Score2 denotes the average ACC trained on the current subset and tested on other subsets.
Method
Midjourney 99.5/72.6
SDv1.4
SDv1.5
ADM
GLIDE
Wukong
VQDM
BigGAN
DIRE
99.7/68.8
99.7/68.8
99.2/67.9
99.8/52.2
99.7/68.1
99.9/51.9
100/50.1
Defake
98.8/78.7
99.8/81.5
100/82.3
98.7/82.5
99.8/73.1
99.3/75.6
99.1/82.0
98.7/76.6
PatchCraft
90.1/81.1
89.5/81.3
90.1/81.3
90.4/79.3
90.6/80.4
92.6/79.3
90.3/74.9
80.9/73.7
AIDE
98.9/86.0
99.7/84.9
99.6/84.0
95,3/79.1
97.6/81.8
98.8/80.4
92.3/83.0
96.3/81.7
DRCT
99.9/89.3
95.5/86.6
96.8/89.1
95.1/81.8
96.6/83.8
99.6/84.4
94.3/82.4
98.8/84.0
STD-FD
99.9/91.9
99.9/90.8
100/89.8
99.5/84.7
100/85.9
100/86.3
99.7/84.4
100/86.9
DRCT
Defake
(d) AIDE
MZ
003
414
00:45
10:3
11.
12:5
67:4
15
200
00/41
10.5
13.6
05.0
190
71.5
$1.5
X0r14
05
2:0
9
506
6--
645
60.7
150
56.9
76.5
59
92.6
54.5
90.5
512
512
00.
100
02.5
19
19:
99.
515
K24
8IHLS
167
W/4
1001
SO.E
62.
10
56
757
84
1800
96.
56
962
50.6
10
15.
91.
95.6
20
064
96
352
30.4
A00I
557
91.6
72.
395
A0L5
515
15
10.5
7MA-
85.3
57.2
105
55.4
47.1
48
56
74.0
54.9
66.9
73
12%
T8-
26.
71.6
Test
GUIDE
303
000
68.7
2012
20.4
10-4
T1
R5.4
MALL
15.2
725
VLD
15-
V1.
96
S6S
Wakerg
97.5
264
94.
62
200
10.4
AL.
95.
11-3
12.3
55.4
50.22
MALL
01
99.5
18.
91-
11.
800
16-5
VQDM
10.3
01.7
62.4
44.5
15.5
75.6
58
50.0
71.
14.
55.0
602
786
23.
77.6
78.
10.
50.
BaGAN
12.4
$2.
06.5
91
52
765
725
41
665
67.4
47.3
71.
Arg-
163
40h
50v
44
4DM
GLIDE
Vinn
AIN
GLADE
Walkug
FORM
A0M4
GRUNE
Vaste
NV
A0M
GLam
Watame
YOHM
Train on
Figure 4. Results (ACC, %) )a of cross-vale volss-valiitiion different training and testing subsets. For each generator, we train model and test it on all 8 generators. (a) illustrates the generalization performance of our proposed method, STD-FD, across different subsets of the GenImage datasct, while (b-d) present the generalization results of the sota models.
In summary, STD-FD achieves the highest ACC in five out of eight identification subsets, and its average ACC sur- passes that of existing forgery identification methods. This highlights the consistent effectiveness of STD-FD (detailed results are provided in Table 10 in the Appendix).
Table 2. Results (AUC, % of Mismatch Between Pre-trained Model and Identification Target. The evaluation follows Deepface- gen Benchmark, identification methods are trained and tested on deepfacegen consisting of real data and forged data generated by 12 prompt-guide methods.
Method Pre-trained Dataset
Cat
Horse
Bedroom
5.3. Generalization Performance
DIRE (Wang et al., 2023)
73.01
65.45
55.04
DRCT (Chen et al., 2024)
74.48
68.78
67.62
To validate the generalizability of the STD-FD, we designed two experimental scenarios: one focusing on constructing data from previously unseen fake forgery methods (i.c., methods not present in the model's training data), and the other examining cases where the pre-trained reconstruction model mismatched with the target recognition task (e.g., as previously mentioned, training a model on cat images but applying it to detect forged dog or even house images).
STD-FD (ours)
92.78
92.45
92.77
algorithms. Moreover, the detailed comparison with the current SOTA models, DRCT (Fig 4 (b)), demonstrates that identification metrics inevitably decline when confronted with unknown forgery methods different from the training data. However, compared to the SOTA method on Gen- Image, DRCT, STD-FD maintains superior generalization ability. This can be attributed to STD-FD's comprehensive extraction of classification features that distinguish real and fake data across both temporal and spatial domains. The approach of modeling the distribution fitting deviation be- tween real and fake data exhibits excellent generalization.
Addressing Unknown Forgery Methods. Following the generalization performance evaluation setup in (Luo et al., 2024), we evaluate the performance of our model on the GenImage dataset by training on one subset and testing on all eight subsets. The experimental results of STD-FD compared with the baseline model DIRE and the top four models currently ranked Genlmage. As shown in Table I, STD-FD achieves the best generalization perfor- mance across all eight subsets compared to the competing
Mismatch Between Pre-trained Model and Identifica- tion Target. As mentioned in the Introduction, existing
7

---

STD-FD: Spatio-Tempore Distribution Fitting Deviation for AIGC Forgery Identification
Table Identification performance (ACC,%) when choosing different classifiers. STD-FD with different classifiers are trained SDv1.4 and evaluated on different testing subsets.
Classifier
Midjourney
SDv1.4
SDv1.5
ADM
GLIDE
Wukong
VQDM
BigGAN
Avg.
LR
91.41
99.99
99.98
80.07
88.84
95.82
89.76
79.84
90.71
RF
93.37
99.98
98.24
81.18
87.79
95.29
91.68
81.03
91.07
SVM
92.45
99.98
99.01
81.57
89.80
95.43
91.55
80.88
91.33
Xgb
93.76
99.99
99.45
81.64
90.31
96.41
92.74
81.79
92.01
forgery detection methods based on reconstruction errors exhibit a catastrophic drop in performance when the data type for forgery detection is inconsistent with the pre-trained reconstruction model. For example, reconstruction models pre-trained on animals may exhibit larger reconstruction er- rors when applied to plants, causing real plant images to be misclassified as fake. Therefore, we conduct generalization experiments under such scenarios for STD-FD. Specifically, we use the LSUN bedroom, LSUN cat, and LSUN horse pre-trained reconstruction models provided by (Dhariwal & Nichol, 2024), and compare the generalization perfor- mance with two reconstruction error-based detection meth- ods, DIRE and DRCT. The evaluation follows Deepfacegen Benchmark, involving training and testing on 12 prompt- guided forgery datasets. The experimental results, as shown in Table 2, reveal a catastrophic drop in generalization per- formance for the reconstruction error-based methods, while STD-FD maintains high generalization capability. Notably, the AUC scores for STD-FD remain above 92% under the cat, horse, and bedroom pre-training scenarios, demonstrat- ing that STD-FD is not significantly affected by the training scenarios of the pre-trate pre-trained reconstruction models.
AU0%
T=
r= 59
95
DALLEE1
DALL-E3
Modjouney
Weazin
Figure 5. Performance (AUC, %) on four challenging subsets of DeepFaceGen when choosing different sampling timestep T.
Table 4. Performance (AUC,%) when choosing different post-
processings on four challenging subsets of DeepFaceGen.
Post- Processocss
Dataset Subset
Scale
QF
DALL-E
D
Midjoumey
Wenxin
0.50
91.45
91.25
94.01
93.22
0.75
91.51
91.20
94.01
93.51
1.00
91.45
91.20
94.01
93.48
1.25
91.57
91.20
93.78
94.01
1.50
91.62
91.07
94.11
93.78
6. Ablation Study
60
90.96
90.97
93.87
93.11
70
90.87
91.04
93.87
93.45
Influence of Classifier. We evaluated STD-FD with classi- fiers beyond XGBoost (XGB), including Logistic Regres- sion (LR), Random Forest (RF), and Support Vector Ma- chine (SVM), using the Genimage Benchmark setup. Re- sults in Table show that classifier choice has minimal impact, with the average AUC exceeding 90% across all classifiers, further confirming STD-FD's robustness.
80
91.03
91.43
93.87
93.21
91.45
91.54
93.95
93.07
100
91.45
91.20
94.01
93.48
with fluctuations under 1%, demonstrating its robustness against various post-processing strategies.
Influence of Spatial and Temporal Modules. Given the inherent temporal structure of the STD-FD network, we focus on ablating the spatial module. In the DeepFaceGen benchmark setup, when superpixel segmentation omitted, the AUC drops from 94.90% to 91.12%, but performance remains superior to other state-of-the-ar methods. This un- derscores the importance of the spatial module and demon- strates the effectiveness of the temporal module's feature extraction in providing a robust engineering solution.
Influence of Sampling Step. To evaluate the effect of sampling timesteps on STD-FD, we conduct experiments on four challenging subsets of DeepFaceGen with sampling timesteps set to 5, 10, 20, and 50. Figure show that the AUC scores of STD-FD consistently exceed 90% across timestep settings, confirming the method's robustness.
Influence of Post-Processing. To assess the resilience of STD-FD against post-processing, follow the experimen- tal setup from (Wu et al., 2023), applying resizing and JPEG compression to images. Using the same setup as in the "In- fluence of Sampling Step" part, the results in Table 4 show that STD-FD consistently achieves AUC scores above 90%,
Influence of Adversarial Attacks. We selected FGSM (Goodfellow et al., 2015), PGD (Madry et al., 2017), C&W (Carlini & Wagner, 2016), and Black-Box attacks (Guo et al., 2019), based on STD-FD's feature mod-
8

---

STD-FD: Spatio-Temporal Distribution Fitting Deviation for AIGC Forgery Identification
Table Performance (AUC, 3) when facing different attacks. on four challenging subsets of DeepFaceGen.
Table 7. Performance (AUC, 9) when facing different K blocks on four challenging subsets of DeepFaceGen.
Attack Type
DALLEE 1
DALILEE
Midjourney
Wenxin
Average
DALL-E 1 DALL-E3
Midjourney
Wenxin
Performance
Raw
91.45
91.20
94.01
93.48
92.53
90:46
90.11
92.89
92.67
-1.08%
RGSM
86.21
90.21
87.51
91.45
90.87
93.76
94,01
-0.01%
PGD 84.21
85.01
84.65
87.02
85.22
10
91.45
91.20
94.01
93.48
Bascline
C&W 83,89
84.45
85.63
88.32
85.57
15
91.89
91.01
93.45
92.93
-0.23%
Black-Box
86.64
87.32
90.22
89.56
88.43
20
92.45
90.89
93.87
91.54
-0.37%
cling and classifier attributes. Using data- aata-based&a adversarial attacks from the preliminary DeepFaceGen experiments, we observed that, although STD-FD's performance decreased from the original 93.48%, the worst performance (85.22% under PGD) still showed a drop less than 7%, maintaining high overall AUC.
poral distribution deviations during image reconstruction. By leveraging superpixel- -based semantic segmentation, we model these deviations as spatio-tempone DF across different semantic modules. Extensive experiments demon- strate the effectiveness of STD-FD, proving its robustness and generalizability. Future work will focus on developing an end-to-end framework to uncover additional distinctive spatio-temporal patterns for AIGC forgery detection.
Influence of Adversarial Perturbations. Following the same experimental settings described in the Influence of Adversarial Attacks section, we conducted additional ex- periments specifically focusing on adversarial perturbations during the diffusion sampling process. Concretely, adversar- ial noise (with L2-norm strengths of [0.01, 0.03, 0.05)) was injected at each timestep of the reverse diffusion process (20 steps in total). Under these adversarial conditions, the performance fluctuates within approximately 2.5%, demon- strating that the STD-FD identification mechanism remains robust against targeted sampling attacks.
Acknowledgements
This work is funded by National Key Research and Devel- opment Project (Grant No: 2022YFB2703 100) and Infor- mation Technology Center, Zhejiang University.
Impact Statement
This paper presents work aimed at advancing deepfake de- tection. Our research contributes to improving the reliability and security of Al-generated content detection, helping mit- igate potential risks associated with deepfake technology. While there are various societal implications of our work, none which we feel must be specifically highlighted here.
Table 6. Performance (AUC,%) when facing adversarial perturba- tions on four challenging subsets of DeepFaceGen.
Perturhation
DALLLE. 1
DALL-E.3
Midjourncy
Wenvin
Performance
0.05
83.01
89.98
93.84
92.57
-255
0.03
89.56
90.43
93.56
93.62
-188
0.01
91.67
91.42
92.90
90.42
-20%
Original 91.45
91.20
94.01
93.48
Baseline
References
Influence of Block Parameters K. We performed an ab- lation study varying the number of superpixel blocks K from the bascline setting K=10. The performance variation across different K values is within approximately 1.08%. It's noteworthy that selecting a larger value of K does not always yield better results. Superpixel methods inherently suggest optimal clustering number based on image con- tent. In facial forgery scenario, the recommended K ensures effective semantic consistency; significantly deviating from this value negatively affects pixel-level semantic coherence and impairs spatio-temporal decoupling during diffusion sampling.
Achanta, R., Shaji, A., Smith, K., Lucchi, A., Fua, P., and Süsstrunk, S. Slic superpixels compared to state-of the art superpixel methods. IEEE Transactions on Pattern Analysis and Machine Intelligence, 34(11)2274-2282. 2012. doi: 10.1109/PAMM..212..0
Bei, Y., Lou, H., Geng, J., Liu, E., Cheng, L., Song. J., Song, M., and Feng, Z. A large-scale universal evaluation benchmark for face forgery detection, 06 2024.
Brock, A., Donahue, J., and Simonyan, K. Large scale gan training for high fidelity natural image synthesis. ArXiv, htw/1809.11099 2018 URL https: //api. s semant cschola ar. wrt. : 52889459.
7. Conclusion
Cao, J., Ma, C., Yao, T., Chen, S., Ding, S., and Yang, X. End-to-end reconstracionnclaasifical face forgery detection. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 4113 4122, June 2022.
In this paper, we introduce STD-FD, a novel approach that uncovers the generative mechanisms behind AIGC- generated fake images, particularly those produced by dif- fusion models. STD-FD systematically explores the tem-
learning for

---

STD-FD: Spatio-Temporal Distribution Fitting Deviation for AIGC Forgery Identification
Cao, Y., Li, S., Liu, Y., Yan, Z., Dai, Y., Yu, P. S., and Sun, L. A comprehensive survey of ai-generated content (aige): A history of generative ai from gan to chatgpt. ArXiv, abs/2303.04226, 2023. URL aattps://api. org/CoopusID:2544C55
Conference on Learning Representations, 2015. URL
http:/ /ttp://aaxee org/ abs / 412. 6572.
Guo, C., Gardner, J. R., You, Y., Wilson, A. G., and Wein- berger, K. Q. Simple black-box adversarial attacks, 2019, URL https: : arxiv org/ abs////////// / 905. 07121.
Ho, J., Jain, A., and Abbeel, P. Denoising diffusion proba- bilistic models. In Proceedings of the 34th International Conference on Neural Information Processing Systems, NIPS '20, Red Hook, NY, USA, 2020. Curran Associates Inc. ISBN 9781713829546.
Carlini, N. and Wagner, D. A. Towards evaluating the robustness of neural networks. 2017 IEEE Sym- posium on Security and Privacy (SP), pp. 39-57, 2016. URL https: http::///.p..sma.iieeee.. www.etmmmmiiiiiieeeeiee... ischhlar.. arg/CorpusID::285 2893830.
Li, J., Xie, H., Li, J., Wang. Z., and Zhang, Y. Frequency- aware discriminative feature learning supervised by single-center loss for face forgery detection. In 2021 IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pp. 6454-6463, 2021. doi: N0.11099VPR44443.220111 011PR446437.022.006633
Chen, B., Zeng, J., Yang, J., and Yang, R. DRCT: diffu- sion reconstruction contrastive training towards universal detection of diffusion generated images. In Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024. OpenReview.net, 2024. URL https: /ectts::/openneee http:///ppp/eeieeeeee http:///eereeeeeeeeeeeeeoerooo 1 1d=oRIwyayrhl.
Li, L., Bao, J., Zhang, T., Yang, H., Chen, D., Wen, F., and Guo, B. Face x-ray for more general face forgery detection. In 2020 IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), pp. 5000-5009, 2020. doi: 10.1 0W099CCPR42200.2200.000
Chen, T. and Guestrin, C. Xgboost: A scalable tree boosting system. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Dis- covery and Data Mining, KDD '16, pp. 785-794, New York, NY, USA, 2016. Association for Comput- ing Machinery. ISBN 978145034223 doi: 10.1 2939672. URL https::/ddo /ttp::////oo..//1.////
Liu, Z., Qi, X., Jia, J., and Torr, P. Global texture en- hancement for fake face detection in the wild. In Pro- the
ceedings the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR), 01 2020. doi: 104485501cX11.2002.00011
Chollet, F. Xception: Deep learning with depthwise separa- ble convolutions. In 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 1800-1807, 2017. doi: 10.1109/CVPR.20117.00
Liu, Z., Lin, Y., Cao, Y., Hu, H., Wei, Y., Zhang, Z., Lin, S., and Guo, B. Swin transformer: Hicrarchical vision transformer using shifted windows. pp. 9902-10002, 10 2021. doi: 10. D.I10//CC49992222200008828
Corvi, R., Cozzolino, D., Poggi, G., Nagano, K., and Verdo- liva, L.. Intriguing properties of synthetic images: from generative adversarial networks to diffusion models. In 2023 IEEF/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 973-982, 2023a. doi: 10.1 109/CVVR.
Liu, Z., Mao, H., Wu, C.-Y., Feichtenhofer, C., Darrell, T. and Xie, S. A convnet for the 2020s. In 2022 IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pp. 11966-11976, 2022. doi: 10. WWW.9/CCVPP222822222220.00
Corvi, R., Cozzolino, D., Zingarini, G., Poggi, G., Nagano, K., and Verdoliva, L. On the detection of synthetic images generated by diffusion models. In ICASSP 2023 - 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1-5, 2023b. doi: 10. 1109/CCASS449357. 10095167.
Luo, Y., Du, J., Yan, K., and Ding, S. Lare2: Latent re- construction error based method for diffusion--enerraed image detection. In 2024 IEEE/CVF Conference on Com- puter Vision and Pattern Recogmition (CVPR), pp. 17006- 17015, 2024. doi: 10. 00111099CVPS223322224000
Ma, R., Duan, J., Kong. F., Shi, X., and Xu, K. Exposing the fake: Effective diffusion--enerraed images detec- tion. ArXiv, abs/2307.06272, 2023. URL. https:
Dhariwal, P. and Nichol, A. Diffusson models beat gans on image synthesis. In Proceedings of the 35th International Conference on Neural Information Processing Systems, NIPS 21, Red Hook, NY, USA, 2024. Curran Associates Inc. ISBN 9781 1 1713445539
saapiissmmnticsschhoe org. www.:/ollar.rrooooooooooeee /CorpusI: 259837077.
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resis- tant to adversarial attacks. ArXiv, abs/1170.00600
Goodfellow, I., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. In International
10

---

STD-FD: Spatio-Temporal Distribution Fitting Deviation for AIGC Forgery Identification
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and 2017. URL http:s////....eeaaccccoooo.r. htg/CCorpuSID3448882 www.stiiccchhll.r..........
Ommer, B. High-resolution image synthesis with latent diffusion models, 12 2021.
McCloskey, S. and Albright, M. Detecting gan-generated imagery using color cues. ArXiv, abs/1812.08247, 2018. URL https:/ htc/CozppuID:56517555
Sha, Z., Li, Z., Yu, N., and Zhang, Y. De-fake: De- tection and attribution of fake images generated by texi-to-image generation models. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS '23, pp. 3418-3432, New York, NY, USA, 2023. Association for Comput- ing Machinery. ISBN 9798400700507. doi: 10.1145/ 3576915.3616588. URL https://dok //tp::///oooor//0... 1 1
McCloskey, S. and Albright, M. Detecting gan- genereteeaedd imagery using saturation cues. In 2019 IEEE Interna- tional Conference Image Processing (ICIP), pp. 4584 4588, 2019. doi: 10.1 10.1199/C1P:20198880666
Midjourney.
Midjourney.
https://wwx
361 6588.
mi midjourney.co - www.commmooo.cceeee..ooo 2022.
Song, J., Meng. C., and Ermon, S. Denoising diffusion implicit models. In International Conference on Learning Representations, 2021. URL htt.s:://///// net/forune met//forum2ii--ttgiiacc. /ttptpps////eereviee.... ope.revie...eeeeeeeeeeeee
Ojha, U., Li, Y., and Lee, Y. J. Towards universal fake image detectors that generalize across generative mod- els. 2023 IEEE/CVF Conference on Computer Vision
and Pattern Recognition (CVPR), pp. 24480-24489, 2023. URL https: http:////aap.smmtissssss.seoe semanticscholaa: :2570334440
Stability.ai. Stable Diffusion. https://stability: a 2023.
Open AI. DALL-E. http://////oooll..cmm//eeee 3, 2023.
Tan, C., Zhao, Y., Wei, S., Gu, G., Liu, P., and Wei, Y. Re- thinking the up-sampling operations in cnn-based genera- tive network for generalizable deepfake detection. In Pro- ceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR), pp. 28130-2818 June 2024a.
Qian, Y.. Yin, G., Sheng, L., Chen, Z., and Shao, Thinking in frequency: Face forgery detection by mining frequency- aware clues. In Computer Vision ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XII, pp. 86-103, Berlin, Heidelherg, 2020a. Springer- ISBN 978-3-030-58609 doi: 10.1007/978-33000-58666666 org/10.
Tan, C., Zhao, Y., Wei, S., Gu, G., Liu, P., and Wei, Y. Frequency-awan deepfake detection: Improving general- izability through frequency space learning, 2024b.
URL https://doo
1007 10010
Tan, M. and Le, Q. V. Efficientnet: Rethinking model scaling for convolutional neural networks, 2020.
Qian, Y., Yin, G., Sheng, L., Chen, Z., and Shao, J. Thinking in frequency: Face forgery detection by mining frequency- aware clues, 2020b.
Wang, J., Wu, Z., Ouyang, W., Han, X., Chen, J. Jiang, Y.GG,, and Li, S.-N. M2tr: Multi-modal multi-scale transformers for deepfake detection. In Proceedings of the 2022 International Conference on Multimedia Retrieval, ICMR '22, pp. 615-623, New York, NY, USA, 2022. Association for Computing Machinery. ISBN 9781450392389.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, I. Learning trans- ferable visual models from natural language supervi- sion. In International Conference Machine Learning, 2021. URL https:/ wwtpppissmaaaticccccceee org/CorpusIDp : 231591445.
doi: 10.1145/ 3512527.3531413, URL https://dol org/10. 0155/3512257.353144
Ricker, J., Damm, S., Holz, T., and Fischer, A. To- wards the detection of diffusion model deepfakes. ArXiv, abs/2210.14571, 2022. URL https: wweeenttccccollrr.oggooooo 25311 16800.
Wang. S.-Y.. Wang. O., Zhang, R., Owens, A., and Efros, A. A. Con-generated images are surprisingly easy to spot... for now. In 2020 IEEE/CVF Conference Com- puter Vision and Pattern Recognition (CVPR), pp. 8692- 8701, 2020. doi: 00.11099CVR442560220000000
Ricker, J., Lukovnikov, D., and Fischer, A. Aeroblade: Training-free detection of latent diffusion images using autoencoder reconstruction error. In Proceedings of the JEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 9140, June 2024.
Wang, Z., Bovik, A., Sheikh, H., and Simoncelli, E. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing, 13 (4):600-612, 2004. doi: 10.1 10.1109/TIP.003.. 01188.11961...

---

STD-FD: Spatio-Tempone Distribution Fitting Deviation for AIGC Forgery Identification
Wang, Z.,, Bao, J., gang Zhou, W., Wang, W. Hu, H., Chen, H., and Li, H. Dire for diffusion-generateed im- age detection. 2023 IEEE/CVF International Confer- ence on Computer Vision (ICCV), pp. 22388-22399 2023. URL https:/ www.api..smaannssccco..eoeo oxt//CorpusDD::2555771..
Wu, H., Zhou, J., and Zhang, S. Generalizable synthetic image detection via seguage-guided contrastive learn- ing, 2023. URL https:/ /ttpas://axxvvv.//ae arbb 13800.
Yan, S., Li. O., Cai, J., Hao, Y., Jiang, X., Hu, Y., and Xie, W. A sanity check for ai- generated image detection. ArXiv, abs/2406.19435, 2024. URL https///app.eenniiccchlll..... org/ brg/CorpusID:270655
Yang, T., Huang, Z., Cao, J., Li, L.,, and Li, X. Deepfake network architecture attribution. In Proceedings of the 36th AAAI Conference on Artificial Intelligncce (AAAI), 2022.
Zhao, W. X., Zhou, K., Li, Tang, T., Wang, X., Hou, Y., Min, Y., Zhang, B., Zhang, J., Dong, Z., Du, Y., Yang, C.,
Chen, Y., Chen, Z., Jiang, J., Ren, R., Li, Y., Tang, X.,
Liu, Z., Liu, P., Nie, J.-Y. and Wen, J.-R. survey of large language models, 2023.
Zhong, N., Xu, Y., Li, S.. Qian, Z., and Zhang, X. Patchcraft: Exploring texture patch for efficient ai-generated image detection, 2023.
Zhu, M., Chen, H., Yan, Q. Huang, X., Lin, G., Li, W., Tu, Z., Hu, H., Hu, J., and Wang. Y. Genimage: A million- scale benchmark for detecting ai-generated image, 2023.
12

---

- Appendia
STD-FD: Spatio-Temporet Temporal Distribution Fitting Deviation for AIGC Forgery Identification
In the appendix, we first present the detailed pseudocode of STD-FD (A) to facilitate better understanding of the method. To further illustrate the key issues addressed by provide exam- ple analysis (B). We then analyze the actual runtime and resource usage of STD-FD (C). Finally, the Detailed Exper- imental Results section presents the comprehensive results of the main benchmark experiments (D).
Algorithm Candidate Discriminative Factors Generation
Input: Time series data {/ J shapelet length L,
ber of candidates M
STD-FD and its design philosophy,
Output: Candidate shapelet set C = |=
1: Initialize an empty candidate set C t- M
2: for each time series h1 do
3: a. Extract
subsequences {sco
length
L: SCO;
sCOs,
[hi,k 11, (aatt.....,,,tt. ,,,++-1),, k 1,,,.... K.)
A. STD-FD Pseudo-code
b. Compute the mean subsequence: sč0
1
To further clarify the implementation process of STD-FD, we provide the core code for its key steps in addition to the open-source code. Specifically, algorithms and 2 detail the generation and selection process the critical spatio- temporal modeling factor, Fattor, in STD-FD.
K₁ scos,k
5:
c. Initialize distance scores:
6:
for each subsequence sCo,, E S; do ((sco,,)) = ||sco,, sčo; end for end for
Algorithm Learning Discriminative Factor
10: Merge all subsequences and distance scores:
N SCO - SCO,, D(sco) for all sco E SCO
Input: Hg. Yk, Cs
Output: Top N discriminative factors 1: Initialize empty list Factorrs
i=1
11: for j j= to M do
2: for each candidate c Cs do
12:
a. Select the subsequence with the highest distance
3: Initialize timing factors Wlocal. Welobal
score:
sco = arg max D(sco)
4: for iter to Maxlteration do
scoESCO
5: i. Compute distances:
13:
b. Add sco" to the candidate set: <- C (sco")
6: Distances
14: c. Update distance scores:
Σ Softmax (-d (C |[iigohall)
15:
for all unselected subsequences sco SCO do
16: D(sco) < D(sco) + ||sco sco" l|
m=
x <d (Wgtoball)
17: end for
7:
ii Compute loss:
18: d. Mark sco" as selected: D(sco*) f- -00
8:
Loss Σ KL (N(44 04), N(u,,o-)
19:
end for
20: return the candidate set C
+a:l W p + + 31[Wgtohalll
9:
ii. Update timing factors: (Wlocat, Wglobal)
10: end for
11: Add (c, Whoul, Wighhnal; Loss) Faacoors
DFactor represents a feature vector derived from diffusion- based spatio-temporal decoupling, characterizing the vari- ation patterns of specific categories. Specifically, DFactor partitions spatio-temporal information into K distinct classes based on feature similarity. Within each class, DFactor codes variation patterns across superpixel regions during sampling. Consequently, these K classes of DFactors consti- tute a feature pattern library. For downstream classification tasks, relevant vectors obtained via identical apatio-tempore decoupling processes can be matched against this library to
end for
Sort D.Fccors by Loss
14:
return top N discriminative factors
We include formalized, abstract definition of DFactor in the final version to provide a clear conceptual paradigm ben- eficial to the research community. Formally, the definition of DFactor follows.
13

---

STD-FD: Spatio-Temporal Distribution Fitting Deviation for AIGC Forgery Identification
achieve precise classification.
changes will be overlooked. For example, in the figure above, the background of the real sample occupies large proportion, but its variation is much smaller than that of facial features. Without basee detailed modeling and analysis, the weight of facial changes in smaller regions would be low and might even be ignored.
These principles can be formalized by the following equa- tion:
C = --gggSe (SI DFactorr 1, ,K..,,, DDFactor K, (TTK )),
(17)
2.If the image is rigidly divided into blocks, the spatial correlation information will be lost. For example, if we divide fake samples into blocks with fixed proportions, the background and the body of the woman will overlap. As seen in the image, the noise distribution changes differently for these two subjects. This is clearly inappropriate, so we adopted the superpixel segmentation algorithm, which creates internally self-correlated image blocks based on semantic information such as color, position, and contrast.
where L quantifies the dissimilarity among samples across K
categories with respect to their DFactors. S ( DFactor; s: Ti) represents the set of distances related to a specific class Ti The function g(-) takes K finite sets as input and outputs scalar value indicating the overall dissimilarity among these sets.
B. Example Analysis
To better illustrate the STD-FD method, we conduct an example analysis in this section. Specifically, we address three core questions related to the conceptualization, design, and implementation of STD-FD through detailed examples. These questions are: (1) QI: Why is temporal information introduced? (2) Q2: Why is spatial information extraction
Table 8. Running Time and GPU Usage Comparisions.
Detection Method
Running Time
GPU Usage
Xception
250ms
5010MiB
EfficientNet
193ms
3580MiB
F3Net
274ms
5100MiB
necessary? (3) Q3: Why use superpixels for segmentation?
Conv-B
267ms
4995MiB
DIRE
365ms
4084MiB
Q1: Why is temporal information introduced? Through the truncation reconstruction process, we found that the re- construction process is dynamic changing process, and the number of steps and the amount of noise added have a signif- icant impact on the reconstruction results. As shown in the Figure 6, when the reconstruction process is not truncated (i.e., with 20 time steps). it does not reflect the optimal point of the real and fake image reconstruction error. The optimal point may exist in the middle of the denoising process (as indicated by the pink box). Simply using the reconstruc- tion results to judge the difference between positive and negative samples is incomplete. Therefore, we propose the introduction of temporal information.
STD-FD
272ms
2253MiB
C. Runtime and Resource Usage
We compare the runtime and memory usage of STD-FD with common baselines. Images are resized to 224x224 with batchsize of 32, and reconstruction-base methods used 20 denoising steps. Experiments are conducted on Silver 4310 CPU and an NVIDIA A40 GPU. As shown in Table 8, even when considering the data reconstruction time, STD-FD's running time remains comparable to that of conventional network architectures. Furthermore, it demon- strates a significant advantage in terms of GPU usage, which can be attributed to the exceptional feature engineering em- ployed in our method. Even with the use of simple classi- fiers such as logistic regression (LR), the model achieves outstanding performance results.
Q2&Q3: Why is spatial information introduced, and why use superpixels for segmentation
We provide intermediate process diagram for the de- noising sampling process of normal and forged samples. Without the guidance of external prompts, the deterministic denoising process is essentially the process in which the diffusion model reconstructs the image through noise dis- tribution. As shown in the figure 7, during the sampling process, noise is actually fitting the shapes and distributions of different semantic subjects. For example, some noise is used to construct the background information of the image, while other noise is used to construct the face and body. This leads us to consider two issues:
D. Detailed Experimental Results
In this section, we provide the detailed experimental re- sults referenced the main text. Specifically, Table 9 and Table 10 present the results of STD-FD compared to all eval- uation methods across all data subsets in the DeepFaceGen Benchmark and GenImage Benchmark experiments.
1.The degree of variation across different regions of the image is not the same. If spatial information is not re- fined through segmentation, crucial information in small
14

---

STD-FD: Spatio-Temports Distribution Fitting Deviation for AIGC Forgery Identification
Original image
Denoising sampling process
step=1 1
step-S 5
step=10 10
step=15 15
step=20
Real
Subtract
Fake
Subtract
Figure 6. Truncated display of image reconstruction. It can be seen that the time step with the largest difference between the real and false samples does exist the result, but in the middle time step in the pink box.
Real
step=1
step=5
step=10
step=15
step=20
Fake
Figure 7. The visualization of noise map results during the image reconstruction process.
15

---

STD-FD: Distribution Fitting Deviation for AIGC Forgery Identification
Table 9. Performance of Various Algorithms across Generators
Generator
Xception
Efficientnet
F3nct
RECCE
DNADet
Freqnet
DIRE
DCRT
UnivFD
NPR
STD-FD (ours)
Midjourney
77.01
79.52
81.65
87.64
93.44
85.69
87.01
89.78
88.67
89.01
94.36
DALL-E 1
73.45
81.74
84.73
83.25
85.62
84.25
86.65
89.91
87.64
89.54
91.21
DALLEE
86.59
88.41
87.23
89.17
83.90
87.13
87.84
88.05
89.21
89.41
90.01
Wenxin
86.87
84.34
89.28
92.
91.60
91.98
92.84
92.72
90.01
92.35
92.90
SDI
87.64
86.83
90.95
89.83
92.40
90.94
92.35
93.56
90.01
90.12
93.77
SDXLR
84.13
93.46
86.40
90.46
89.03
89.40
88.61
89.51
89.01
88.64
93.50
89.72
89.00
92.72
96.90
94.04
93.08
91.28
92.45
88.01
90.28
97.05
pix2pix
83.42
77.61
81.21
89.71
88.52
88.66
89.01
91.51
89.54
89.30
92.34
SD2
87.79
85.91
89.11
95.43
92,70
90.92
89.54
90.41
91.45
90.01
96.71
SDXL
86.06
87.65
91.43
96.75
92.28
92.61
91.54
91.01
90.01
89.87
97.05
VD
85.02
83.84
89.52
95.67
89.21
96.55
98.78
94.25
89.68
91.01
DE-GAN
95.42
96.71
93.45
93.54
94.22
97.11
90.32
92.54
95.01
98.88
Average
85,42
86,25
88.14
91.70
90.58
90.69
90.69
90.48
91.30
89.85
94.90
Table 10. Comparison of Methods Across Various Forgery Generators Accuracy (ACC, % comparisons of STD-FD and other generated image detectors. All methods were trained on GenImage/SDv 1.4 and evaluated on different testing subsets.
Method
Midjourney
SDv1.4
SDv1.5
ADM
GLIDE
Wukong
VQDM
BigGAN
Avg.
CNNSpot
84.92
99.88
99.76
53.48
53.80
99.68
55.50
49.93
74.62
F3Net
77.85
98.99
99.08
51.20
54.87
97.92
58.99
49.21
73.51
CLIP/RN50
83,30
99.97
99.89
54.55
57.37
99.52
57.90
50,00
75.31
GramNet
73.68
98.85
98.79
51.52
55.38
95.38
55.15
49.41
72.27
De-fake
79.88
99.86
99.62
68.62
71.57
98.42
78.43
74.37
84.73
Conv-B
83,55
99.99
99.92
51.75
56.27
99.91
58.41
50.00
74.98
Swin-T
62.11
99.99
99.88
49.85
67.62
99.01
62.28
57.63
74.79
UnivFD
91.46
96.41
96.14
58.07
73.40
94.53
67.83
57.72
79.45
DIRE
50.40
99.99
99.92
52.32
67.23
99.98
50.10
49.99
71.24
PatchCraft
79.00
89.50
89.30
77.30
78.40
89.30
83.70
72.40
82.30
AIDE
79.38
99.74
99.76
78.54
91.82
98.65
80.26
66.89
86.88
DRCT
91.50
95.01
94.41
79.42
89.18
94.67
90.03
81.67
89.49
STD-FD (ours)
93.76
99,99
99.45
81.64
90.31
96.41
92.74
81.79
92.01
16


Reviews:
[{"review_id": "0EAlEnlW5o", "reviewer": "Reviewer_9Lcb", "summary": "This work presents the Spatio-Temporal Distribution Fitting Deviation (STD-FD) method for detecting image forgery in AI-Generated Content (AIGC), specifically leveraging generative diffusion models. The authors designed DFactors, which capture deviations in temporal distribution during the diffusion process. Extensive experiments were conducted to analyze the effectiveness of the proposed method under various experimental settings.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for acknowledging our work. **However, there is a significant misunderstanding: we do not use intermediate steps from the forgery generation architecture (Model A). Instead, we employ a general diffusion model (Model B) to obtain its intermediate process. Without knowing the specific architecture used for generating fake images, we map the images into a latent space and model the spatio-temporal distribution based on that latent temporal information**. Below are responses to your questions (Q) and weaknesses (W):\n\n**Q1/W1: Clarification on Task Definition**\n\nApologize for any ambiguity. Our work focuses on binary image authenticity detection by disentangling spatio-temporal distribution differences between real and synthetic images. This is achieved through analyzing time-step noise patterns via DDIM sampling (unrelated to forgery generation). \n\n**Q2/W2: Assumption on Intermediate Diffusion Information & Experimental Fairness**\n\nSorry for the misunderstanding. We clarify that no assumptions are made regarding access to original generative models (Model A). Instead, our framework uses publicly available DDIM sampling (Model B) to capture temporal noise dynamics. As illustrated in Figure 1a, STD-FD integrates the sampling process natively, ensuring practical applicability. The acquisition of intermediate diffusion features constitutes our key innovation rather than an unfair experimental advantage. \n\n**Q3/W3: Alternative Methods & Complexity**\n\nSorry for the confusion.\n\na) Upon initially discovering the importance of temporal sampling differences, we indeed experimented with simpler alternatives. Initial experiments with 3D-Xception and ViT achieved 87.48% and 88.01% AUC on DeepFaceGen – comparable to SOTA but below our method. The key improvement is the careful decoupling of temporal discrepancies, inspiring the fine-grained design of our STD-FD approach centered around the DFactor module.\n\nb) STD-FD requires 272ms (2253MiB) per image (Line 761), comparable to Xception (253ms/2090MiB) and EfficientNet (241ms/1985MiB).\n\n**Q4/W4: Superpixel vs. Patch-based**\n\nThanks for your question.\n\nQualitative:  Superpixel segments images into regions with similar color, texture, and low-level features, producing blocks more consistent with pixel-level semantics than uniform grid partitioning. Such spatial processing is essential for effectively decoupling temporal noise maps. For example, superpixel segmentation can distinguish distinct temporal variation patterns between human subjects and backgrounds, as detailed in Appendix B (Figure 7 for a specific case analysis).\n\nQuantitative: Our ablation study demonstrates that superpixels outperform the patch-based and no-segmentation baselines by +2.04% and +3.15% AUC, respectively. Detailed experimental results on the 12 forgery subsets, following the guidelines of this rebuttal, are provided on an anonymous link (if interested: https://anonymous.4open.science/r/STDFD/README.md ).\n\n**Q5/W5: a) Experiments with different sampling conditions; b) Sampling steps; c) Sampling methods**\n\nAppreciate your advice.\n\na) Yes, Influence of sampling steps (line 416) show improved detection performance with increasing timesteps (from T=5 to 50). Notably, even at T=5, the AUC surpassed 90%, outperforming SOTA. This underscores the efficacy of modeling forgery traces via spatio-temporal distributions.\n\nb) Please see a).\n\nc) We incorporated additional sampling methods, including DDPM, DPM-Solver, and Progressive Distillation. Experiments followed the identical setup used in the influence of sampling steps study (line 416):\n- Reverse process of DDPM involves a stochastic Markov chain with randomness at each step. With limited steps, noise errors accumulate significantly, reducing the quality and efficiency of spatio-temporal features compared to deterministic methods (ideal results require around 1000 steps).\n- DPM-Solver reformulates diffusion sampling as solving an ODE using higher-order solvers, providing excellent image reconstruction quality in just 20 steps. Although high-quality outputs and superior FID scores are achieved, computational overhead inevitably increases due to the higher-order ODE solution.\n- Progressive Distillation (PD) utilizes pretrained DDIM as teacher model, training a student model to mimic the teacher’s performance in fewer steps. Although sampling times significantly decrease, a performance drop of 1.5% is observed due to changing the optimization objective.\n\n| Method       | DALLE·1 | DALLE·3 | Midjourney | Wenxin | AUC Change | Sampling Time|\n|--------------|---------|---------|------------|--------|------------|---------------------|\n| DDPM| 86.4| 86.3| 89.0| 87.3| -5.8%| ~+43%|\n| DPM-Solver| 91.6| 90.7| 93.4| 95.6| +0.3% | ~+4%|\n| PD| 89.6| 88.3| 92.7| 93.9| -1.5%| ~-27%|\n| DDIM (Baseline) | 91.4| 91.2| 94.0| 93.4  | -  | - |\n\n**W6: Equation Corrections**\n\nThanks for meticulous review. We will rectify all notation inconsistencies in the final version.", "claims_and_evidence": "The paper presents two core claims. \n\n### 1. The proposed spatiotemporal distribution extraction framework requires further examination in terms of its validity and applicability.  \n\n#### 1.1 Validity of the Method  \n\n**Overly idealized assumptions about information acquisition:**  \nThe method assumes access to update information at each time step of the diffusion process, specifically the noise term \\( \\epsilon \\). However, in real-world scenarios—particularly in forgery detection—such information is extremely difficult to obtain. This assumption is overly strong, as it essentially grants direct access to the complete generative process of the model. If this information were available, one could infer the model’s sampling mechanism and potentially reconstruct the generative model itself, making additional forgery detection unnecessary.  \n\n#### 1.2 Potential Overdesign of the Method  \n\nThe proposed approach involves multiple steps:  \n- Extracting variation information between diffusion time steps.  \n- Identifying specific patterns within these variations.  \n- Performing pattern matching to detect forged images.  \n\nThis process is relatively complex and may contain unnecessary design redundancies. A simpler alternative might be more feasible. For instance, if intermediate results of the diffusion process were accessible, applying downsampling or other transformations directly on these results for classification might achieve similar or even superior performance. Thus, the paper should at least include such an approach as a baseline for comparative experiments.  \n\n### 2. Recommendations for Experimental Design  \n\nAlthough the paper conducts extensive experiments, additional ablation studies could provide a more comprehensive evaluation of the method’s effectiveness. These include, but are not limited to:  \n- **Comparing with simpler baseline methods:** For example, using intermediate diffusion model outputs for classification instead of employing a complex spatiotemporal distribution extraction framework.  \n- **Investigating robustness across different diffusion models, sampling strategies, and acceleration techniques:** This includes comparing distilled vs. non-distilled models to assess their impact on the method’s robustness.", "methods_and_evaluation_criteria": "### **Ambiguity in Task Definition**  \n\nA fundamental issue in the paper is the lack of a clearly defined task. In forgery detection, the forgery detection task can take multiple forms, such as:  \n\n- **Patch-Level Detection:** Determining whether a specific region of an image has been manipulated or forged.  \n- **Model Attribution:** Identifying which generative model was used to produce an entire image.  \n\nSince the paper does not explicitly specify which task the proposed method is designed for, it becomes difficult to assess the appropriateness of the method’s design and evaluation metrics. Furthermore, this ambiguity may lead to uncertainty in interpreting the experimental results, ultimately weakening the method’s applicability and generalizability.  \n\n### **Unjustified Methodological Design**  \n\n#### **Strong Assumption**  \nThe method relies on access to intermediate time-step updates of the diffusion model, specifically \\( \\epsilon \\). However, such information is typically unavailable in practical applications. As a result, the method is built on an overly idealized assumption, raising concerns about its feasibility in real-world forgery detection tasks.  \n\n#### **Questionable Necessity of the Method**  \nAs previously mentioned, the proposed framework employs a complex spatiotemporal distribution extraction approach. However, more straightforward alternatives—such as directly classifying intermediate diffusion model outputs—may suffice. The paper does not provide comparative experiments to validate the relative advantages of its approach, casting doubt on the necessity of its methodological design.  \n\n### **Validity of Evaluation Metrics**  \n\nThe work uses metric, such as classification AUC, which is a standard.", "theoretical_claims": "The work does not make any theoretical claims and, therefore, does not include theoretical analysis.", "experimental_designs_or_analyses": "### **Issues in Experimental Analysis**  \n\n- The paper does not clearly define the specific task (e.g., **patch-level forgery detection** vs. **model attribution**). This lack of clarity makes it difficult to accurately assess the validity of the experimental design.  \n- As previously discussed, the method relies on an overly strong assumption—namely, access to intermediate diffusion time-step information. This assumption affects the interpretability of the experimental results.  \n\n### **Sufficiency of Experiments**  \n\nThe paper conducts a large number of experiments, which is a notable strength. However, concerns remain regarding the validity of the experimental design, particularly in two key areas:  \n\n#### **Fairness of Experimental Design**  \n- The proposed method benefits from access to diffusion time-step information, which may provide it with an inherent advantage.  \n- In contrast, the baseline methods used for comparison do not have access to this information, potentially leading to an unfair comparison.  \n- The paper does not sufficiently discuss or address this unfairness in the experimental setup.", "relation_to_broader_scientific_literature": "The paper focuses on a highly specific topic—**forgery detection**. The study is related to broader fields such as **trustworthy AI** and **privacy protection**.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "### **Strengths**  \n\n1. **Large-Scale Experiments**  \n   - The paper conducts a substantial number of experiments, demonstrating thorough empirical validation.   This comprehensive experimental evaluation is a notable strength of the study.  \n\n---  \n\n### **Weaknesses**  \n\n1. **Unclear Task Definition**  \n   - The paper does not explicitly define the specific objective of the forgery detection task. For example:  \n     - Is the goal to detect whether a specific region of an image has been manipulated?  \n     - Or is it to identify which generative model produced the entire image?  \n   - The lack of task definition makes it difficult to evaluate the applicability of the proposed method.  \n   - The paper should clearly specify **which specific task the method is designed for** and **justify the choice of this task**.  \n\n2. **Strong Assumption on Accessibility of Intermediate Diffusion Steps**  \n   - The method assumes **access to intermediate time-step information of the diffusion process (e.g., \\(\\epsilon\\) updates)**, which is typically **unavailable in real-world forgery detection scenarios**.  \n   - In practice, forgery detection usually relies on analyzing the final synthesized image without access to the generative process.  \n   - The paper should **justify the validity of this assumption** or explore the feasibility of the method **without this assumption**.  \n\n3. **Potential Overdesign of the Method**  \n   - The proposed framework involves **a complex spatiotemporal variation extraction pipeline**, including:  \n     - Computing similarity across different time steps.  \n     - Analyzing changes in similarity over time.  \n     - Identifying patterns in these changes.  \n     - Matching patterns with images using gradient descent.  \n   - This multi-step process introduces extra computational complexity and potential design redundancies.  \n   - **Lack of Exploration of Simpler Alternatives**:  \n     - If intermediate diffusion steps are accessible, why not directly use these frames with downsampling?  \n   - The paper should:  \n     - **Analyze the computational complexity of the method**.  \n     - **Compare the proposed approach with simpler alternatives** to demonstrate its necessity.  \n\n4. **Unclear Justification for Spatial Information Extraction Strategy**  \n   - The method extracts spatial information using a **superpixel-based approach** instead of a more conventional **patch-based** method.  \n   - The paper may clarify:  \n     - **Why was the superpixel approach chosen over simpler patch-based methods?**  \n     - **Has the effectiveness of different spatial extraction strategies been compared?**  \n\n5. **Uncertainty in the Method’s Generalizability Across Different Diffusion Sampling Strategies**  \n   - The method relies on intermediate updates within the diffusion process, but its effectiveness under different sampling strategies remains unclear.  \n   - **Potential Factors Affecting Performance**:  \n     - **Variation in sampling steps across models** (e.g., Model A samples in 10 steps, while Model B samples in 5).  \n     - **Differences in ODE-based solvers** (e.g., DDIM vs. DPM-Solver).  \n     - **Applicability to stochastic sampling methods** (e.g., the paper adopts a deterministic approach like DDIM—does the method work with stochastic sampling?).  \n     - **Effectiveness on distilled diffusion models**.  \n   - The paper does not explore these concerns and should:  \n     - **Conduct experiments to analyze the method’s robustness across different sampling strategies, step counts, and diffusion models**.  \n     - **Discuss the impact of various sampling techniques on the method’s effectiveness**.", "other_comments_or_suggestions": "Typos in Eq. 15.", "questions_for_authors": "1. **What specific forgery detection task is the method designed for?**  \n   - Is the goal to detect local manipulations within an image or to attribute the image to a specific generative model?  \n   - What is the motivation behind choosing this particular task?  \n\n2. **How does the method remain feasible without access to intermediate diffusion steps?**  \n   - Given that real-world forgery detection scenarios do not typically provide access to diffusion process updates (e.g., \\(\\epsilon\\)), how can the method be adapted to work without this assumption?  Is there empirical evidence supporting the validity of this assumption?  \n\n3. **Why is the proposed method designed with such a complex multi-step framework?**  \n   - What advantages does this pipeline offer over simpler alternatives (e.g., direct classification using intermediate diffusion outputs with downsampling)?  Has the computational complexity been analyzed to justify the need for each step?  \n\n4. **Why was a superpixel-based approach chosen for spatial information extraction?**  \n   - How does it compare to a more conventional patch-based method?  \n\n5. **How well does the method generalize across different diffusion sampling strategies?**  \n   - Does the method perform consistently when applied to diffusion models with varying step counts, solvers (e.g., DDIM vs. DPM-Solver), or stochastic sampling approaches?  \n   - Is the method still effective when used with distilled diffusion models?  \n   - Have experiments been conducted to assess the robustness of the approach under different sampling conditions?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "1BKi0Sg3WO", "reviewer": "Reviewer_71VX", "summary": "This paper proposes STD-FD, a detection framework for AI-generated image forgeries that analyze spatio-temporal distribution deviations inherent in diffusion models' generative processes. By modeling how noise residuals evolve across temporal sampling steps and decomposing spatial patterns through superpixel segmentation, the method identifies discriminative features (DFactors) that reveal distribution mismatches between authentic and synthetic content. Unlike artifact-based approaches, STD-FD focuses on dynamic inconsistencies in the generation trajectory, achieving superior detection accuracy through systematic quantification of temporal noise propagation anomalies and localized spatial irregularities. The core innovation lies in bridging temporal modeling of diffusion behaviors with spatial forgery localization, offering a principled detection paradigm for evolving AIGC synthesis techniques.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you very much for your detailed review and constructive comments. We sincerely appreciate your recognition of the innovation and thoroughness of our work. Below are our responses to your Questions (Q) and Weaknesses (W):\n\n**Q1|W1: Is the essence of the distribution fitting bias the temporal variation in noise distribution, or is it an implicit constraint of the generative model itself? Can the authors provide further clarification?**\n\nWe apologize for any confusion. The essence of the distribution fitting bias lies in the temporal variations of noise distributions. Although DDIM employs a diffusion-based architecture, we use intermediate DDIM timesteps solely to extract spatio-temporal distribution information inherent in real and forged data, rather than fitting specifically to a particular network architecture. Our experimental results provide strong evidence across two benchmarks, effectively detecting forgeries generated from different architectures, including DF-GAN and BigGAN (GAN-based) as well as the DALLE series (autoregressive-based).\n\n**Q2|W2: A formal or axiomatic definition of DFactor should be used to delineate its core principles, further separating conceptual essence from specific implementations.**\n\nThank you for your valuable suggestion. We will include a formalized, abstract definition of DFactor in the final version to provide a clear conceptual paradigm beneficial to the research community.\n\nFormally, the definition of DFactor is as follows:\n\n> DFactor represents a feature vector derived from diffusion-based spatio-temporal decoupling, characterizing the variation patterns of specific categories. Specifically, DFactor partitions spatio-temporal information into **K** distinct classes based on feature similarity. Within each class, DFactor encodes variation patterns across superpixel regions during sampling. Consequently, these **K** classes of DFactors constitute a feature pattern library. For downstream classification tasks, relevant vectors obtained via identical spatio-temporal decoupling processes can be matched against this library to achieve precise classification.\n\nThese principles can be formalized by the following equation:\n$\n\\mathcal{L} = -g\\left(S_1(\\text{DFactor}_1, \\mathcal{T}_1)\\, S_2(\\text{DFactor}_2, \\mathcal{T}_2)\\,\\dots\\,S_K(\\text{DFactor}_K, \\mathcal{T}_K)\\right)\n$\n- $\\mathcal{L}$ quantifies the dissimilarity among samples across **K** categories with respect to their DFactors.\n- $S_i(\\text{DFactor}_i, \\mathcal{T}_i)$ represents the set of distances related to a specific class $\\mathcal{T}_i$.\n- The function $g(\\cdot)$ takes **K** finite sets as input and outputs a scalar value indicating the overall dissimilarity among these sets.\n\n\n**Q3: Corrections of writing**\n\nThank you for your careful reading and valuable feedback. We will carefully correct these writing issues in the final version.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "Yes", "theoretical_claims": "Yes", "experimental_designs_or_analyses": "Yes", "relation_to_broader_scientific_literature": "The field of Deepfake detection has predominantly focused on amplifying artifacts through frequency/spatial domain transformations, while recent advances (LARE2 [CVPR'24], AEROBLADE [CVPR'24], DRCT [ICML'24]) explore image reconstruction-based paradigms. \nThis work innovates by addressing a critical oversight of existing end-to-end reconstruction approaches: their neglect of temporal dynamics during the reconstruction process. The key contribution lies in systematically modeling spatio-temporal distribution characteristics of genuine versus synthetic samples throughout Diffusion-based reconstruction trajectories, establishing more discriminative forgery signatures through principled analysis of generation process deviations.", "essential_references_not_discussed": "No", "other_strengths_and_weaknesses": "Strengths:\n1.\tDetection Paradigm Innovation: By leveraging a spatio-temporal diffusion framework, this method moves beyond prior reconstruction-error-based approaches (e.g., DRCT) to systematically decompose distribution discrepancies between real and forged images. \n2. Implementation Framework: Rather than simply classifying noise-variant frames end-to-end, STD-FD builds a discriminative knowledge repository via joint spatio-temporal modeling. This effectively reframes forgery detection as a feature engineering task guided by repository comparisons.\n3. Experimental Validation: Large-scale tests on DeepFaceGen and GenImage demonstrate strong performance. Ablation studies, tests with mismatched pre-trained models, and resistance to adversarial attacks underscore its robustness.\n4. Deployment Feasibility: The open-source release ensures reproducibility. Its lightweight distribution-matching mechanism is resource-efficient, favoring real-world deployment.\nWeaknesses:\n1. Is the essence of the distribution fitting bias the temporal variation in noise distribution, or is it an implicit constraint of the generative model itself? Can the authors provide further clarification?\n2. A formal or axiomatic definition of DFactor should be used to delineate its core principles, further separating conceptual essence from specific implementations.", "other_comments_or_suggestions": "1. Correct \"In the recent years\" to \"In recent years.\"\n2. Some sentences should be restructured for clarity, e.g., \"By using spatio-temporal distribution fitting deviations...\" could be clearer as \"Spatio-temporal distribution fitting deviations capture changes in the generative process, enabling effective forgery detection.\"", "questions_for_authors": "Please refer to the above comments.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "kYvvhUtJqL", "reviewer": "Reviewer_918Q", "summary": "This paper proposes an AIGC forged image detection method based on Spatio-Temporal Distribution Fitting Deviation (STD-FD). For forged images, the authors decompose the spatio-temporal features of the generation process, employ superpixel segmentation to divide semantic units, and extract the DFactor in the spatio-temporal domain by combining the noise distribution changes of the diffusion model during the denoising process. Experiments show that STD-FD outperforms existing methods on well-known datasets such as GenImage and DeepFaceGen, especially in terms of cross-generator generalization and anti-post-processing robustness.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate your recognition of our method's novelty and effectiveness. Below are our responses to your Questions (Q) and Weaknesses (W):\n\n**W: Addressing targeted attacks against diffusion sampling mechanics would strengthen real-world applicability claims.**\n\nThank you for your insightful feedback. Following the same experimental settings described in the \"Influence of Adversarial Attacks\" section, we conducted additional experiments specifically focusing on adversarial perturbations during the diffusion sampling process. Concretely, adversarial noise (with L2-norm strengths of [0.01, 0.03, 0.05]) was injected at each timestep of the reverse diffusion process (20 steps in total). Experimental results are summarized below (AUC,%):\n| Perturbation | DALLE·1 | DALLE·3 | Midjourney | Wenxin | Performance |\n|-----------------------|---------|---------|------------|--------|--------------------|\n| 0.05                  | 88.01   | 89.98   | 93.84      | 92.57  | -2.5%              |\n| 0.03                  | 89.56   | 90.43   | 93.56      | 93.62  | -1.8%              |\n| 0.01                  | 91.67   | 91.42   | 92.90      | 90.42  | -2.0%              |\n| Original (Baseline)   | 91.45   | 91.20   | 94.01      | 93.48  | Baseline           |\n\nUnder these adversarial conditions, the performance fluctuates within approximately 2.5%, demonstrating that the STD-FD identification mechanism remains robust against targeted sampling attacks.\n\n**Q1: How do the parameters of superpixel segmentation (e.g., the number of blocks K) affect performance?**\n\nThank you for this constructive question. We performed an ablation study varying the number of superpixel blocks Kfrom the baseline setting K=10. The performance variation across different K values is within approximately 1.08%, as summarized below (AUC,%):\n\n| K  | DALLE·1 | DALLE·3 | Midjourney | Wenxin | Performance |\n|----|---------|---------|------------|--------|--------------------|\n| 1  | 90.46   | 90.11   | 92.89      | 92.67  | -1.08%             |\n| 5  | 91.45   | 90.87   | 93.76      | 94.01  | -0.01%             |\n| 10 (Baseline) | 91.45 | 91.20   | 94.01      | 93.48  | Baseline           |\n| 15 | 91.89   | 91.01   | 93.45      | 92.93  | -0.23%             |\n| 20 | 92.45   | 90.89   | 93.87      | 91.54  | -0.37%             |\n\nIt's noteworthy that selecting a larger value of K does not always yield better results. Superpixel methods inherently suggest an optimal clustering number based on image content. In facial forgery scenario, the recommended K≈10 ensures effective semantic consistency; significantly deviating from this value negatively affects pixel-level semantic coherence and impairs spatio-temporal decoupling during diffusion sampling.\n\n**Q2: What is the training overhead (GPU usage and training time) of the method?**\n\nThank you for your question. STD-FD involves diffusion sampling, DFactor construction, and downstream classification during training. The peak GPU memory usage during training is approximately 18.8GB. With a batch size of 32, the average training time per epoch is approximately 3 minutes 30 seconds (tested on NVIDIA A40 GPU with Intel Silver 4310 CPU).\n\n**Q3: Ethical Review**\n\nSorry for the confusion. As stated in our Impact Statement, our research strictly targets deepfake detection, aiming to mitigate potential risks posed by generative AI technologies. We do not facilitate unethical use; rather, our work enhances reliability and security in detecting AI-generated content. Therefore, we respectfully submit that our research aligns with standard ethical guidelines.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "Yes", "theoretical_claims": "Yes. The paper's core theoretical contributions are rigorously anchored in diffusion fundamentals (DDPM/DDIM frameworks), with Eq.(7) demonstrating proper alignment to established reverse process derivations. \n\nThe spatio-temporal modeling innovation (Eqs.12-14) introduces a mathematically sound mechanism for capturing temporal variation patterns via minimal-distance sampling. The discrepancy detection framework effectively operationalizes DFactors through three-dimensional feature engineering (matching, distance, correlation), forming a cohesive detection pipeline. \n\nThe theoretical scaffolding supports the empirical claims.", "experimental_designs_or_analyses": "Yes", "relation_to_broader_scientific_literature": "Proactive defense mechanisms have targeted GAN/autoregressive architectures with notable success. The text-to-image revolution driven by diffusion models, however, renders conventional reconstruction-based detection (inherited from GAN-era paradigms) increasingly inadequate. \n\nThis work transcends the \"reconstruction error\"[1,2,3,4] doctrine by establishing spatio-temporal distribution discrepancy modeling through diffusion sampling dynamics—a strategic alignment with cutting-edge diffusion applications in image decomposition/editing[5,6]. The paradigm shift from artifact amplification to generative process deconstruction represents advancement in next-generation AIGC defense frameworks.\n\nReference:\n\n[1]“DIRE for Diffusion-Generated Image Detection”(ICCV) (2023).\n\n[2]\"AEROBLADE: Training-Free Detection of Latent Diffusion Images Using Autoencoder Reconstruction Error\"(CVPR) (2024).\n\n[3]\"DRCT: diffusion reconstruction contrastive training towards universal detection of diffusion generated images\"ICML(2024).\n\n[4]\"Aligned Datasets Improve Detection of Latent Diffusion-Generated Images\"ICLR(2025).\n\n[5]\"SwiftEdit: Lightning Fast Text-guided Image Editing via One-step Diffusion\"CVPR(2025).\n\n[6]\"Preference Alignment on Diffusion Model: A Comprehensive Survey for Image Generation and Editing\"arXiv preprint arXiv(2025).", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "**Strengths**: This work establishes a paradigm shift in AIGC detection through spatio-temporal noise distribution dynamics analysis during diffusion sampling—a marked departure from static artifact detection. The integration of superpixel-guided semantic unit analysis with distribution fitting deviations demonstrates methodological novelty. Superior robustness is evidenced by rigorous cross-domain validation (GenImage/DeepFaceGen) against diverse generators (SD, DALL-E), coupled with deployment-friendly efficiency (Xception-level inference speed). The well-structured presentation and open-sourced implementation ensure both conceptual clarity and technical reproducibility.\n\n\n**Weaknesses**：While adversarial robustness is partially validated via FGSM/PGD attacks, the evaluation lacks coverage of emerging diffusion-specific adversarial perturbations (e.g., latent space manipulation attacks). Addressing targeted attacks against diffusion sampling mechanics would strengthen real-world applicability claims.", "other_comments_or_suggestions": "1. Line 166: \"Noise Reshaping\" should be \"Noise Normalization.\"\n2. Line 180: \"GDTW\" should include a citation, as should Line 271.\n3. Line 273: $match(c_k, c)$ should be $match(a_k, c_k)$.", "questions_for_authors": "1. How do the parameters of superpixel segmentation (e.g., the number of blocks $K$) affect performance?\n2. What is the training overhead (GPU usage and training time) of the method?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethical_review_flag": "Flag this paper for an ethics review."}}, {"review_id": "JY0g6TdhQK", "reviewer": "Reviewer_uUED", "summary": "In this paper, the authors propose a deepfake detection method based on “temporal distribution fitting deviations.” Specifically, they argue that existing reconstruction-based approaches treat the diffusion model as a black box, which limits their generalizability. In contrast, the authors decouple the sampling process and detect forgery features by predicting temporal inconsistencies across different time steps.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for recognizing our work. Below are our responses to your questions (Q).\n\n**Q1: Methodological Coupling & DFactor Universality**\n\nSorry for the misunderstanding. Reconstruction-based approaches rely on the magnitude of reconstruction error to distinguish real from fake images. When the reconstruction model encounters data from an unfamiliar domain, its robustness deteriorates. Our method instead uses a diffusion model to map images into a latent space, from which we **extract their temporal variations**.\n\n>To illustrate, consider a simplified scenario in which 5 and 80 represent pixel values from two distinct domains. Reconstruction-based methods attempt to reconstruct them (e.g., 5 → 4.9 and 80 → 70), leading to large errors when dealing with domain shifts (e.g., transitioning from cat to human, or from a diffusion-generated fake to a GAN-generated fake). In contrast, our approach **tracks the feature variation over time**, such as:\n1 → 2 → 3 → 4 → 4.9 and 50 → 55 → 60 → 65 → 70. Although the numerical values differ greatly, both sequences share a **similar variation trend** (akin to a slope in mathematics or acceleration in physics). Based on this observation, we design a spatio-temporal distribution modeling framework centered on DFactor, thereby decoupling from semantic content.\n\nTo clarify this principle, we visualized the average temporal changes of 256 pixels for cross-domain forgery data projected into latent space. The results show (Following the guidelines of this rebuttal, visualizations can be seen on anonymous website https://anonymous.4open.science/r/STDFD_re/README.md , if interested) :\n\n- Significant Differences between Real and Fake Data: Real images exhibit irregular, larger-scale changes due to the absence of fixed generative constraints, whereas forgeries conform to specific generative paradigms (GAN/diffusion/autoregressive) and have smaller, more uniform variation patterns.\n\n- Consistent Trends across Different Subjects and Architectures: Whether it’s a cat vs. a person, or a GAN vs. diffusion vs. autoregressive model, the amplitude of temporal change remains similar. **This amplitude (or trend) is precisely what motivates our design of DFactor**.\n\nFurthermore, the sampler we use was pretrained on general content, making it adept at lower-level semantic reconstruction. This capability facilitates an effective mapping of images into the latent space for our approach.\n\n**Q2: Superpixel Effectiveness**\n\nQualitative: The superpixel algorithm segments images into semantically coherent regions based on similarities in color, texture, and pixel-level low-level features. For example, human figures and backgrounds naturally form distinct semantic regions. Superpixel-based segmentation effectively decouples their individual temporal variation patterns during sampling. A detailed analysis and illustration of this benefit can be found in Appendix B (see Figure 7).\n\nQuantitative: Experiments comparing superpixel and patch-based methods confirm improved performance. Superpixels outperform the patch-based and no-segmentation baselines by +2.04% and +3.15%.  Detailed experimental results on the 12 forgery subsets are provided on anonymous link ( https://anonymous.4open.science/r/STDFD_re/README.md , if interested).\n\n**Q3: Generalization Capability**\n\nQualitative: Please refer to Q1.\n\nQuantitative: STD-FD achieves SOTA detection performance across two benchmarks involving GAN-based (DF-GAN, BGAN) and autoregressive-based models (DALLE series), supporting its general applicability.\n\n\n**Q4:  Mitigating Model-Target Mismatch**\n\nPlease refer to Q1.\n\n**Q5: Diffusion Model Interchangeability**\n\nThanks for this practical question. Due to computational efficiency and sampling quality, we primarily use DDIM. To validate robustness, we compared DDIM with alternative sampling methods (DDPM, DPM-Solver, and Progressive Distillation):\n| Method       | DALLE·1 | DALLE·3 | Midjourney | Wenxin | AUC Change | Sampling Time|\n|-------------|---------|---------|------------|--------|------------|-------------------|\n| DDPM| 86.4   | 86.3| 89.0| 87.3  | -5.8%| ~+43%|\n| DPM-Solver| 91.6| 90.7| 93.4| 95.6 | +0.3%| ~+4%|\n| Progressive Distillation| 89.6| 88.3 | 92.7| 93.9  | -1.5%| ~-27%|\n| DDIM (Baseline) | 91.4| 91.2| 94.0 | 93.4  | - | - |", "claims_and_evidence": "The claims in the methodology section are clear. However, the paper does not thoroughly discuss how the proposed method specifically addresses its motivation—for instance, how it effectively eliminates the strong coupling between the reconstruction model and the detection method. Additionally, it remains unclear whether the DFactor exists across all models and whether it follows the same distribution in different models.", "methods_and_evaluation_criteria": "The evaluation metrics are feasible.", "theoretical_claims": "The proposed pipeline, ie, DFactor set construction, DFactor selection, and forgery detection, is relatively clear. However, the reviewer is confused on the Spatial Information Capture. Specifically, why does the use of superpixels lead to improved performance in diffusion models? Is there any theoretical justification for this claim? The paper does not seem to provide a rigorous explanation, leaving this aspect unconvincing.", "experimental_designs_or_analyses": "The experimental setting is sound.", "relation_to_broader_scientific_literature": "The proposed method should primarily be considered within the scope of Deepfake detection, especially for detecting forgeries generated by diffusion models. Whether it possesses strong detection capabilities and generalization ability for other types of forgeries remains an open question and requires further discussion.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "In addition to the aforementioned unclear descriptions, there are additional concerns:\n\n1. Regarding the “Mismatch Between Pre-trained Model and Identification Target”, while the authors demonstrate strong performance of the proposed method under this condition, it remains unclear why the method is able to mitigate this issue to such a significant extent. A more detailed explanation is needed to support this claim.\n\n2. What specific diffusion model is used in STD-FD? Is this model interchangeable? If so, how does the detection performance change when a different diffusion model is used?", "other_comments_or_suggestions": "N/A", "questions_for_authors": "If the authors can address the concerns, the reviewer would consider increasing the rating.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The submission received one weak reject, two accepts, and one weak accept. The authors provided detailed responses, which, while not overturning the negative rating, convinced the Area Chair that the submission's strengths and contributions outweigh its weaknesses.
Decision: Accept (poster)