FerretNet: Efficient Synthetic Image Detection via Local Pixel Dependencies
Authors: Shuqiao Liang
Jian Liu
Chen Renzhang
Quanlong Guan
Venue: NeurIPS 2025 poster ()
Keywords: Synthetic Image Detection
Local Pixel Dependencies
Markov Random Fields
Image Forensics
Primary area: deep_learning

Abstract: The increasing realism of synthetic images generated by advanced models such as VAEs, GANs, and LDMs poses significant challenges for synthetic image detection.
To address this issue, we explore two artifact types introduced during the generation process: (1) latent distribution deviations and (2) decoding-induced smoothing effects, which manifest as inconsistencies in local textures, edges, and color transitions.
Leveraging local pixel dependencies (LPD) properties rooted in Markov Random Fields, we reconstruct synthetic images using neighboring pixel information to expose disruptions in texture continuity and edge coherence.
Building upon LPD, we propose FerretNet, a lightweight neural network with only 1.1M parameters that delivers efficient and robust synthetic image detection.
Extensive experiments demonstrate that FerretNet—trained exclusively on the 4-class ProGAN dataset—achieves an average accuracy of 97.1% on an open-world benchmark comprising 22 generative models. Our code and datasets are publicly available at https://github.com/xigua7105/FerretNet.

FerretNet: Efficient Synthetic Image Detection via Local Pixel Dependencies
Shuqiao Liang
Jian Liu
Renzhang Chen" Quanlong Guan'
Jinan University
(xigua7105, 1iujian2143)@gma11 com, (jnulion, gql) edu, on
Abstract
The increasing realism of synthetic images generated by advanced models such as VAEs, GANs, and LDMs poses significant challenges for synthetic image detection. To address this issue, explore artifact types introduced during the generation process: (1) latent distribution deviations and (2) decoding-inducee smoothing effects, which manifest inconsistencies in local textures, edges, and color transitions. Leveraging local pixel dependencies (LPD) properties rooted in Markov Random Fields, we reconstruct synthetic images using neighboring pixel information to expose disruptions in texture continuity and edge coherence. Building upon LPD, propose FerretNet, a lightweight neural network with only 1.1M parameters that delivers efficient and robust synthetic image detection. Extensive experiments demonstrate that achieves an average accuracy of 97.1% % on an open-world benchmark comprising 22 generative models. Our code and datasets are publicly available at httph:t://// /7 / thub. com/ 10taaa/////errre.eeee
exclusively on the 4-
class ProGAN dataset-achieves
Introduction
The field of Al-based image generation has progressed rapidly, driven by the development of powerful generative models such Variational Autoencoders (VAEs) [23] Generative Adversarial Networks (GANs) [19 (22 [I. and Latent Diffusion Models (LDMs) [4 9.. These models have enabled widespread applications across art, entertainment, and e-commerce, allowing users effortlessly create realistic and engaging images. However, the potential misuse of such content has raised ethical
concerns and driven extensive research on synthetic image detection [5] TO 31 27
Many existing detection approaches rely heavily on model-specific features, which limit their general- ization ability to unseen generative architectures. For example, Durall et al. [8] observed characteristic frequency artifacts GAA-ggeeerted images. Although frequency-domain techniques [51] [6] 17
have demonstrated strong performance under known conditions, they often struggle generalize across different models. DIRE [52] introduced a diffusion-based detection framework that distin- guishes synthetic images by reconstructing them through diffusion model, capability that fails with real images. However, this method performs poorly when applied to GAN-generated content.
To address the generalization challenge, Ojha al. [3 explored the utilization of pre-trained models, employed frozen backbone for image encoding, providing universal representations from pre-training, followed by linear classifier. FatFormer [27] introduced an Adaptor to CLIP (38) to enhance the pre-trained model's ability to learn artifacts. While these methods achieved encouraging results, they constrained by large parameter counts low computational efficiency.
To overcome the dual challenges of limited generalization and computational inefficiency in synthetic image detection, we conduct a comprehensive analysis of artifact patterns shared across GAN-, VAE-,
Corresponding authors.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

and LDM-based generative models. Our analysis reveals that visual anomalies-such as unnatural textures, geometric distortions, and poor object-background integration prrimarll originate from Two sources: (1) distributional shifts in the latent variable and (2) over-smoothing and color
discontinuities introduced during the decoding process.
Based on these insights and grounded in the theory of Markov Random Fields, we introduce a pixel-level artifact representation that captures local pixel dependencies (LPD) through median- based reconstruction. We further propose FerretNet, a lightweight detector incorporating depthwise separable and dilated convolutions achieve a balance between computational efficiency and representational power.
Contributions of this work are follows:
We propose a novel approach that leverages Markov Random Fields and median-based statistics capture local pixel dependencies for detecting artifacts and anomalies in synthetic images.
We present Synthetic-Pop. a 600-600imm -imaee benchmark for evaluating detection models against high- fideliid generators, containing 30K synthetic images from six models and 30K real images from COCO [5 details.
and LAION- Aesthetts V2 (6.5+) [55] See Appendix A for more
We introduce FerretNet, lightweight model with only 1.1 million parameters, which achieves 97. 17.1% accuracy on synthetic image detection across 22 generative models, while maintaining low computational overhead.
2
Related Work
We categorize existing synthetic image detection methods into two main paradigms: pixel- and frequency-based approaches.
2.1 Pixel-based Synthetic Image Detection
Wang et al. [51] trained a classifier on images generated by a single model to detect fake images across various architectures and datasets, addressing cross-mode generalization via data augmentation and diverse training samples. Shi et al. [47] proposed a difference-guie guided reconstruction learning framework that exploits discrepancies between real and synthetic images to enhance detection accuracy. Ojha et al. [31 tackled the generalization problem to unseen generative models by leveraging a feature space explicitly trained for real/fake discrimination, employing nearest- re-synthesis technique reconstruct test images and extract residual layered artifact features, thereby reducing reliance on frequency artifacts. Tan et al. (50) proposed NPR, a method that revisits the upsampling process in generative CNNs by modeling Neighbor Pixel Relations, aiming to improve generalization in deepfake detection. Liu et al. [26] designed a robust detection framework based on multi-view image completion, which simulates real image distributions and captures erequency-indeeendee adaptive transformer incorporating forgery- specific adapters and saggaag--giddes alignment modules to better adapt pre-trained models for synthetic image detection. CO-SPY [2] leverages a frozen CLIP encoder for semantic features and a VAE-based reconstruction difference for artifacts, integrating them via adaptive fusion for robust synthetic image detection.
neighbor and linear probing strategies. He et al. [3 introduced a super-resolution-bene
features. FatFormer (27] presented forgery-
2.2 Frequency-based Synthetic Image Detection
F3Net 37 introduced a dual-branch architecture that captures frequency-aware clues for detecting subtle forgery traces, particularly in low-quality and facial imagery. FrePGAN [7 developed frequency-level perturbation GAN framework, where gemerator-discriminen pair used to itera- tively improve classifier robustness against unseen categories and generative models. Tan et al. [48] exploited pre-trained CNN gradients to generate generalizable representations of GAN-specific artifacts. BiHHF [16] amplified frequency-level artifacts via high-pass filtering approach, achieving improved robustness across diverse image categories, color manipulations, and generative models. FreqNet 44 introduced high- fegg-frequency representations and frequency-spece convolution layers to

---

enhance detection by focusing on localized high- freehffreuency components, addressing overfitting and poor generalization seen in prior methods. SAFE [24] leverages the high-frequency component the Discrete Wavelet Transform to extract forensic artifacts and employs data augmentation techniques including Colorlitter, RandomRotation, and a patch-based RandomMask mechanism to improve the model's generalization and robustness.
3 Artifacts in Synthetic Image Generation
This section provides a high-level, intuitive framework to motivate our search for universal artifacts. We establish the general principle that all generative models, despite architectural differences, introduce artifacts. While these artifacts have multiple high-level sources (c.g., latent space, decoding), work chooses to focus detecting powerful and universal effect-the disruption of local pixel statistics-whihh effectively captured by our LPD method.
3.1 Image Generation Pipeline
Generative models such as VAEs, GANs, and LDMs are widely used for image synthesis. Despite differences in architecture and training objectives, these models share a common two-stage generation pipeline, as illustrated in Figure
1. Obtaining the latent variable
In LDMs, the generation process begins with Gaussian noise e ~ (0, I), which itera- tively denoised into latent representation within the compressed latent space of a pre- trained autoencoder, using a denoising network such as U-Net 41 or Diffusion Transformer In contrast, VAEs and GANs directly sample from predefined prior distri- butions, such as standard normal distribution (0, I) or uniform distribution U(-1,
Denoising Network
Decoder
repmmaration
Image
darzitttion
The image generation process in VAEs, GANs, and LDMs be broadly divided into two stages: obtaining the latent variable 2, and decoding it into an image.
Figure 1:
(DiT) 33 54
2. Decoding to generate images: In both VAEs and LDMs, decoder transforms into the final image through a series of convolutional layers with specific kernel sizes and strides. In GANs, the generator plays analogous role, mapping to the image space with the aim of approximating the target data distribution.
While this two-stage framework enables high-fidelity image synthesis, it can also introduce artifacts such as texture irregularities, unnatural transitions, and local detail loss. These artifacts commonly arise from two major sources: (1) deviations in the distribution of the latent variable and (2) imperfections introduced during the decoding process.
3.2 Latent Distribution Deviations
The quality synthetic images exhibits significant sensitivity the distribution of the latent repre- sentation [40 [4] 5 57]. Ideally, the sampled distribution Q(z) should match the prior distribution P(z) assumed or learned during training. However, in practice, factors such as data imbalance or insufficient training can lead to a mismatch between Q(z) and P(z). This discrepancy can be quantified using the Kullback-Leibler (KL) divergence:
/ Q(2)) log
Q(2) P(z)
((L()()))P(2))
dz 8,
(I)
where 5 denotes an acceptable divergence threshold. When this threshold is exceeded, the resulting images are prone visible artifacts, including texture inconsistencies and the loss of fine structural details. For example, in GANs, if the latent space poorly aligned with the true data distribution, the generator may fail to reproduce realistic textures, resulting in unnatural or distorted outputs [53)

---

STOP
(a) COCO
(b) LAION
(c) BigGAN
(d) SDXL-Turbo
(e) StyleGAN
(1) RealvisXL-4.0
Figure 2: Local pixel dependencies (LPD) comparison between real and synthetic images. Top row: real images (COCO, LAION) and synthetic images (BigGAN, SDXL-Turbo, StyleGAN, Real 4.0). Bottom row: LPD maps derived from neighborhood median reconstruction emphasize structural differences.
3.3
Artifacts from the Decoding Process
Even when z accurately sampled, decoding artifacts may still arise due to limitations the network architecture 21 The kernel size and stride used in convolutional layers are particularly influential in determining the fidelity of the output [22]. Large kernels may over-smooth local features, while improper stride configurations can lead to aliasing, both of which degrade image quality.
Moreover, upsampling operations-Such as nearest-neighbor or bilinear interpolation-ant are known introduce specific artifacts. Nearest-neighbor interpolation often produces jagged edges, whereas bilinear interpolation may blur textures due to its smoothing effect. These operations can significantly impact the realism and perceptual quality of the generated images, especially in high-frequeng, regions.
Methodology
4.1 Local Median-based Feature Extraction
Natural images exhibit strong local statistical consistency due to the underlying physics of light and matter, where neighhoring pixels highly correlated. Generative models, however, often struggle perfectly replicate these subtle, complex statistics during the synthesis of high-frequency details. This struggle leads microscopic disruptions in local pixel dependencies. We propose synthetic image detection method based on local statistical dependencies. The core idea is to identify generation artifacts by quantifying the deviation each pixel from the median of its surrounding neighborhood. The full computational procedure is outlined in Algorithm II
Let denote the input image, and æt, represent the pixel value at location (i.j). According the Markov Random Field (MRF) assumption, the probability distribution of a pixel depends only on its local neighborhood. Specifically.
P(æis æn,, (k, + (i.j)) P(xi,) Tk.i, (k, E NV.)),
(2)
where Nr, is the set of neighboring pixels located within an x window centered at (i.j). excluding the center pixel itself:
i m S k skksiiiinn m, J m sisssmi )
Nr.
(3)
(k, + (i.j)
with n = 2m and m E *
To enhance the robustness of the median filtering process and prevent contamination from generated pixels, we introduce zero-masking strategy that replaces the center pixel with zero before computing the median. This adjustment is particularly beneficial when the neighborhood contains

---

Algorithm Local Dependency Feature Extraction via Zero-Masked Median Deviation
Input: 1: Image tensor of shape (C, H, W); Neighborhood size (n is odd)
Output: LPD: Feature map shape (C, H, W)
I: # Compute padding size and center index
p - In/2]. center_ide _idx + |
3: # Pad the image to handle borders
4: Ipad t- PI ,adding = p, mode = "constant', value = 0)
5: # Extract n X 71 local patches centered at each pixel
6: panches Unfoldd( (pad. kernel_siie
n) // shape: (C, n², H W)
# 7ero out the center pixel in each patch
8: punches(i.center cintte__ixx,,
9: # Compute median along patch dimension
10: moed Median (puches,, dim 1)
Reshape match original image dimensions
12: 1' + Reshape meds shape- = (C, H, W))
13: # Compute local pixel dependency map
14: LPD +- I-I--
15: return LPD
3x3
3x3
EN kull
Row Imug
LTD
I' Femei Black
AdU
Porky
Fereet Blnck
Podjet
Aviyy
Poges
Cotv LXI
Ceea lx!
to
Linear
Ferme Block
AC01
6,30
9,200
Real/Pike
Locol Pixel Dependencies Captared Median Based Recorstruction
of FerretNet
Figure 3: Pipeline of FerretNet: computation of local pixel median discrepancy for artifact represen- tation, followed by lightweight detection using depthwise separable and dilated convolutions.
number of pixels. The median-based reconstruction at location (i,j) is therefore computed as:
Vi.j Median (k, E Ni
where Ni
0} is the extended neighborhood that includes the masked center pixel.
By applying the above operation to all pixels, obtain median-reccostrruted image 1', where each pixel value replaced by its corresponding Ys.j-- The final local pixel dependency (LPD) feature map is then computed as the pixel-wise difference:
LPD -
(5)
Since both and conform to local dependency assumptions, the LPD feature map effectively captures pixel-level inconsistencies and subtle structural deviations, offering strong cues for distin- guishing synthetic from natural content, as illustrated in Figure _
This method effectively integrates the local dependency modeling capabilities of Markov Random Fields with the robustness of median filtering, providing a principled and resilient strategy for detecting subtle inconsistencies in synthetic imagery.
4.2 FerretNet Architecture
FerretNet is a lightweight convolutional neural network designed to achieve balance between computational efficiency and feature extraction capability. As illustrated in Figure 3 the network begins with two conventional 3 convolutional layers for initial feature extraction, each followed by Batch Normalization (BN) [5] and ReLU activation.

---

At the core of FerretNet are four cascaded Ferret Blocks, which progressively refine the extracted convolution, global
features while keeping the model compact. The final stage comprises average pooling, Dropout regularization, and fully connected layer for classification.
The key innovation lies in the Ferret Block, which is designed to expand the effective receptive field under constrained network depth, thereby enhancing the model's capacity for local pattern extraction. Each Ferret Block adopts dual-path parallel architecture to increase the receptive field:
The primary path employs 3 x 3 dilated grouped convolution with a dilation rate of 2. The number of groups equals the number input channels, allowing the receptive field to expand without increasing the number of parameters.
The secondary path utilizes a standard 3 x grouped convolution, maintaining the same grouping structure to capture fine-grained local patterns.
This dual-path configuration approximates a sparse enabling FerretNet to simulate deeper network behaviors within shallower layers, thus reducing computational cost. The outputs from both paths are fused through a x 1 convolution, followed by BN and ReLU activation. Additional 3 3 grouped and x 1 convolution layers further enrich the feature representation. Residual connections are employed to facilitate stable gradient propagation and enhance learning stability.
receptive field via parallel processing,
5
Experiments
5.1
Dataset Construction
5.1.1
Training Dataset
To ensure a consistent evaluation baseline, we follow the protocols established in 16
31 27 50)
utilizing four semantic classes (car, cat, chair, horse) from the ForenSynths dataset [1] Each class contains 18,000 synthetic images generated by ProGAN [1), paired with an equal number of real images from the LSUN dataset [56]. All methods compared in this study were trained or fine-tuned on this same limited ProGAN 4-class dataset, except for CO-SPY [2], which utilized its officially released weights trained on other datasets.
5.1.2 Testing Dataset
To assess the generalization ability of the proposed method under real-world conditions, we evaluate its performance on diverse synthetic and real images from four distinct test sets, comprising a total of 22 generative models:
ForenSynths. This test set includes synthetic images generated by eight representative generative models: ProGAN (19), StyleGAN (20), StyleGAN2 [21]. BigGAN []] CycleGAN (58), Star-
GAN (3) GauGAN (32], and Deepfake [43. Real images are sourced from six widely-used datasets:
LSUN [56) ImageNet (44, CelebA 229] CelebA-HQ [8]. COCO 25 and FaceForensies++ 43
totaling 62,000 images.
Diffusion-6-cls. As described in FatFormer 27 this test set comprises synthetic images generated by six diffusion-based models collected from DIRE [52 and Ojha al. [i], including DALL-E (39), Guided 77. PNDM (28) VQ-Diffusion [T]. Glide 300 and LDM [41]. Variants produced by Glide and LDM with different parameter configurations treated separate categories (see original papers for details). Each subset includes 1,000 synthetic and 1,000 real images, with some real
images reused across subsets.
Synthetic-Pop. To capture the latest progress in high-resolution image generation, we constructed the Synthetic-Pop dataset using six popular models Oppnjouunyy [36.. Proteus-O.3 (6] Real 4.0 [6]. with 5,000 captions randomly sampled from COCO (25) Real images were drawn from COCO and LAION-Aesthetics V2 (6.5+) [45]. resulting in six subsets, each containing 5,000 synthetic and 5,000 real images (60,000 images total).
(9]. SDXL-Turbo [34], and YiffyMix 55 Each model was prompted
Synthetiic-Aestheii further investigate the aesthetic and stylistic diversity of synthetic imagery, sampled 40,000 images from the Simulacra Aesthetic Captions (SAC) dataset (35), which were

---

generated by VimpVis latent GLIDE 41 and Stable Diffusion 41 using prompts sourced from over 40,000 real users. An equal number of real images were sampled from LAION- V2 (6.5+) 45 resulting in a total of 80,000 images. This dataset provides challenging benchmark for evaluating performance under realistic and user-driven conditions.
5.2
Implementation Details
FerretNet is trained from scratch without any pretraining. We use the Adam optimizer with a learning rate of 2 x 10-A betas of (0.937, 0.999), and weight decay of 5 x 10 The model is trained for 100 epochs using a batch size of 32. During training, input images are randomly cropped to resolution of 224 x 224 and augmented with random horizontal flipping. Binary Cross Entropy with Loggts Loss (BCEWithl Logitsl.oss is adopted as the loss function. For evaluation, images are center-cropped to 256 256.
Following previous work [16] 31 27]. Accuracy (ACC) and Average Precision (AP) are used as the primary evaluation metrics. To measure real-world performance, report throughput on the Synthetie-Aestheti test set using an NVIDIA RTX 4090 GPU and an Intel(R) Xeon(R) Gold 6430 CPU (16 vCPUs), with batch size of 128.
5.3 Main Results
Table I: Accuracy and average precision comparisons with peer methods on ForenSynth test set for different GAN images and Deepfake images. The best and second best performance are highlighted in bold and underlined, respectively.
Methods
ProGAN
StyleGAN
StyleGAN2
BigGAN
CycleGAN
StarGAN
GaaGAN
Deepfake
Mean
Wang [51
91.49994
63.8/914
76.4/77.5
52.9/73.3
72.7/88.6
63.8/90.8
63.9/22.2
51.7/22.3
67.1/86.9
F3Nel 27
99.4/100.0
92.6/99.7
88.0/99.8
65,3699.
76.4/84.3
100.0/1000
58.1/56.7
63.5/78.8
80.4786.2
FrePGAN Lir
99.0/99.9
60.7/89.6
6/98/
69.2/71.1
7/.4/74.4
99.9/100.0
60.3/71.7
70.9/919
79.4/87.2
BiHPF 16
90.7/86.2
76.9/75.1
76.2/74.7
84.9/81.7
81.9/78.9
94.4/94.4
09.5/78.1
54.4/54.6
78 78.6/77.9
LGrad [8
99.9/100.0
94.8/999
96.0/99.9
82.9/90.7
85.3/940
99.6/100.0
72.4/79.3
58.0/67.9
86.1/91
Ojha
99.7/100.0
89.0/98.7
83.9/98.4 4
90.5/99.1
87.9/998
91 4/1000
89.9/100.0
80.2/90.2
1/98//8 3
FreeNet [9
99.6/100.0
90.2/99.7
88.099.55
90.5/96.0
95.8/99.6
85.7/99.8
93.4/98.6
88.9/94.4
91.5/98.5
NPR 50
99 19,8/100.0
96.3/99.8
97 97.3/100.0
87.5/94.5
95.0/99.5
99.7/100
86 6/88.8
77.4/86.2
92. 92.5/96.1
FatFormer
99.9/100.0
97.2/99.8
98.8/99.9
99.5/100.0
99.3/100.0
99 8/10000
99 99.4/100.0
93.2/988.0
98.4/99.7
SAFE 24
99.9/100.0
98.0/99.9 9
98 6/160/
89.7/95.9
98. 08.9/99.8
99 00.9/100.0
91,5/97,2
93.1/97.5 5
96, 2/988/
CO-SPY
74.7/78.1
63.9/70.2
59.7/63.1
71.6/83.9
58.5/55.8
62.1/94.3
69 60.6883.4
65.7/79.7
63.7/76.1
FerretNet (Our)
99.9/100.0
98.0/100.0
98. 98.5/100.0 92.6/98.5
98.8/9999
99.1/100.0
91,499.8
89.2/66.7
95.9/99.3
Table 2: Accuracy and average precision comparisons with peer methods on Diffusion-6-chh test set.
Dataset
Wang 51
LGirad (18
Ojha 31
FregNet 49 NPR 50
Fatioommr
27
SAFE 24
CO-SPY 2
FerretNet
Dall-B E
51.8/61.3
88. 88.5/97.3
89.5/96.8
97.3/99.7
90.9/98.1
98.8/99.3 8
97.5/9997
81,8/7722
91.4/98.2
Guided
54.9/66.6
86.6/1000
75.7/85.1
67.2/75.4
74.0/78.
76. 1/92.0
82.4/95.8
62.5/86.0
92.1
PNDM
50.8/90.3
69.8/98.5
75.3/92.5
85.2/99.9
97.5/100.0
99.3/100.0
78.9/98.6
53.0/55.6
96.9/100.0
VQ-Diitusion
50.0/71.0
96.3/100.0
83.5/97.7
100.0/100.0
100,0/100.0
100.0/100.0
100.0/100.0
71.97115
99.9/100.0
Glide-00-27
54.2/76.0
90.7/95.1
91.1/97.4
86.6/95.8
97.5/99.5
94.7/99.4
96.6/99.2
1/74.6
97.2/99.7
Glide-100-10
$3.3/72.9
89.4/94.9
90.1/97.0
87,8/96.0
97,8/99.5
94,2/99.2
97.3/99.4
76.6/81.6
97,9/99.9
Gldd-1100-27
53.0/71.3
87.4/93.2
90.797.2
84.4/95.6
97.4/99.5
94.4/99.1 1
95.8/98.9
73.5/78.2
97.3/997
LDM-100
51.9163.7
94,8/99.2
90.5/97.0
97.8/99.9
98.0/99.6
98.7/99.9 9
98. 08.8/100.0
82.7786.9
98.8/100.0
LDM-200
52.0164.5
94 2/99. I
90,2/97.1
97.4/99.9
98.2/99.6
98. 28.6/99.6 8
98.8/100.0
83. 1/87.5
98.8/100.0
LDM-200-CFG
51.6/63.1
05.9/99.2
77.3/88.6
97.3/99.9
98.0999.5
94.9/99.1
98.7/99.9
85.3/9
98.5/99.9
Mean
52.4/70.1
89.4997.7
85.4994.6
90.1/96.2
94.9/9733
95.098.8
94.5/99.1
73.9/80.0
96.9/999.
We begin by evaluating FerretNet on GAN-based and Deepfake images using the ForenSynths test set. As shown in Table it achieves an average accuracy (ACC) of 95.9%, outperforming lightweight baselines such as FreqNet [49 (91.5% and NPR (50) (92.5%). Although FatFormer [27] reports higher ACC of 98.4%, it relies on pre-trained CLIP weights, whereas FerretNet achieves competitive accuracy with significantly fewer parameters.
Next, on -ennraaed images (Table 2) FerretNet attains an ACC of 96.9% and an AP of
99.6%, outperforming FatFormer [27] by 1.9 and 0.8 percentage points (pp), respectively. Other
lightweight models such as NPR (50), FreqNet [49 and SAFE 24 perform less favorably, with ACC scores falling below 95.0%.
7

---

Table 3: Accuracy and average precision comparisons with Sfate-of-the-aaee methods on Synthetic-
test set.
Methods
Openjournyy
Proteus- 0.3
RealVisXI.44r
SD-3.5-Medium
SDXI--Turbu
YiffyMix
Mean
Not 20
56.3 63.6
44.0/41.2
77.5/86.0
74.3 74.3/8444
65.0/7144
NPR 50
78.8/83.5 83.5
68.6 69.3
78.1 82200
80.4/ 84,1
78.2/829
80.0/851.
77.4 77.4/81.2
FalFormer 27
58.87654
93.9 97.6
49.0741.7
81.9 89.1
58.7/65.3
80.9/89.9
70.5 74.8
SAFE 24
94.7/99.3
99.2
07.9/99.5
98.1 99.77
98.1
99.5/99.9
97.9 99.77
CO-SPY
92,4/97.6
88.8/93.0
79.0/86.5
/7.9
79.9/88.3
92,9/97.5
85.67 91.8
FerretNet
98.4/99.7
99.6
98.8/99.9
97.21996
98.9/ 100.0 97.8/99.7
98.3 99.8
Table 4: Performance comparisons with state-of-the-art methods across four distinct sets. Throughput measurements were conducted on the Synthetic-Aesthele test set. Upward arrows indicate that higher values are better, while downward arrows signify the opposite.
Methods
Image size
Params (M)
FLOPs (G)
FPS f
ACC
PreqNet 49
AAAI 2024
256
1.85
2.58
200.2
79.2 86,8
NPR 50
CVPR 2024
256
144
2.29
720.9
86.5 89.4
FatFormer 27
CVPR 2024
224
492.59
269.92
88.6
86.1
256
CO-SPY
2
CVPR 2025
384
963.05
644.80
26.3
76.5 83.8
FerretNet (Ours)
256
1.06
2.38
772.1
97.1/99.5
We further evaluate performance on high-quality synthetic images using the Synthetic- test set (Table 3). Some existing methods experience noticeable degradation; for example, NPR [50) achieves only 77.4% ACC and 81 $1.2% AP. In contrast, FerretNet maintains 98.3% ACC and 99.8% AP, highlighting its robustness and reliability visually realistic forgeries.
To evaluate real-world applicability, we tested FerretNet on four distinet test sets for both detection performance and efficiency. As shown in Table 4 FerretNet achieves 97.1 % ACC and 99.6% AP with 1.06M parameters and 772.1 FPS on an RTX 4090. Notably, outperforms FatFormer [27 by 11.0 and 8.6 pp in ACC and AP, respectively, while using only 0.2% of its parameters.
Finally, Appendix B provides detailed analysis of specific success and failure cases, further clarifying the model's decision boundaries.
5.4 Ablation Study
Unless specified, all ablation results report the average ACC and AP across four datasets: ForenSynths, Diffusion-6-dee 6-cls, Synthetic-Pop. and Senthetic-Aesthette More supplementary experiments see Appendix C
5.4.1
Impact of Different Local Neighborhood Sizes
Table 5: Impact of the local neighborhood size.
Size (n x v))
ACC/ AP on the Test set
Inputs
3 x
5
x
ForenSynths
Diffusion-G-els
Synthetic-Pop
Syathetie-Assthetie
Mean
84.6/
96.8
LPD
d
95.9 / 99.3
96.9 / 99.6
98.3 99.8
97.3 99.6
97.1 / 99.6
91.8
99.3
91.1
99,99
LPD
82,4/900
85.27 93.6
78.6/91.9
85.0 /4.0/
82.8 62.8/922
Table shows that LPD extracted using x 3 local neighborhood substantially enhances detection accuracy compared to raw input I. Average ACC improves from 86.9% to 97.1% (+10.2%), and AP rises from 93.5% to 99.6% (+6.1% However, performance deteriorates the neighborhood size increases. For instance, using a neighborhood weakens feature discrimination and significantly reduces detection accuracy.
This trend aligns with the structural characteristics of generative models, which typically employ 2x upsampling and small convolutional kemness (1 1 or 3 x 3). The 3 neighborhood is particularly

---

effective in capturing localized decoding artifacts for two reasons: 1) It matches the scale of operations used in generative architectures, making ideal for exposing subtle synthesis artifacts; 2) It captures local pixel variations while suppressing potential noise artifacts.
5.4.2 Impact of Center Pixel Processing Methods
According to Section 4.1 the neighborhood median yi.j should satisfy two key requirements: reducing the interference of center pixels in median computation, and ensuring the median value equals real pixel value from the neighborhood set when possible, thus enhancing statistical correlation with the original image. To validate the effectiveness of zero-value masking strategy, we compared three center pixel processing methods:
Set the center pixel to zero while keeping in the set. This in- creases the probability that the median equals real neighborhood pixel and reduces the center pixel's influence.
1. Zero-value Masking:
Table 6: Impact of center pixel processing meth- ods on metries (ACC/AP): average results across varying local neighborhood sizes.
Methods
3 x
X
7 x
Complete Exclusion: Remove the center pixel entirely. This results in non-existent pixel value (i.e., not from the original image), thereby weakening the dependency the source image.
Mask 97.1/
93.9/ 98.0
82.8/ 12.6
Exclusion
95.1/98.8
90.5/96.3
86.4/93.6
Retention
93.3/97.6
89.7
87.5/95
Keep the original center pixel, as in standard median filtering. This approach compromises the ability to detect local anomalies.
Center Pixel Retention:
The experimental results in Table dembonttaattt that for local neighborhood sizes of 3 x 3 and 5 5, the zero-value masking achieves the highest detection accuracy, followed by the complete exclusion, with the center pixel retention yielding the lowest accuracy. These findings validate the effectiveness of the proposed strategy.
5.4.3 Impact of Neighborhood Statistic Selection
To verify the advantages of the neighborhood median-based feature extraction strategy in syn- thetic image detection, we designed three alter- native methods: selecting the maximum, min- imum, and average values from the neighbor- hood. The center pixel masked by setting it to infinity, negative infinity, or zero, respectively, to reduce its influence on feature extraction. The experimental results in Table show that, for both 3 and 5 x 5 local neighborhoods, the median strategy significantly outperforms the other methods.
Table 7: Impact of neighborhood statistic selection methods.
Mothods
x
Max
93.6/97.9
86.8 / 94.3
88.9 99.88
92.2/97.2
88.2 94.4
90.0 99666
Min Med
91.8 /9.9
88.3/94.7
87.6 94.0
98.0
82.8 /2..6
5.4.4 Impact of Different Backbones
Table 8: Comparison of different backbones with and without LPD as input.
We evaluated ResNet50 [12, Xception 4 and our proposed FerretNet on both raw image 7 and L.D inputs. As shown in Table g, FerretNet achieves competitive accuracy on raw images despite having significantly fewer parameters, and outperforms the other architectures when leveraging LPD. Across all backbones, replac- ing with LPD consistently delivers accuracy gains with negligible effect on inference speed.
Methods
Parmms
w/o
Throughput
ACC/
Xception
20.8 M
x
730.5 Img/s
89.8 /9.1
v
710.6 Img/s
95.1 98.8
755 Img/s
75.0/ 80.3
ResNer50
23.5
V
750.9 Img/s
81.1 85.6
FerretNet
777.8 Img/s
86.9 93.5
772.1 Img/s
97.1 99.6
Conclusion
This work presents a universal artifact representation framework and introduces FerretNet, lightweight yet effective neural network for synthetic image detection. FerretNet achieves re-

---

markable 99.8% reduction in parameters compared to the state-of-the-an art method FatFormer [27]. while maintaining exceptional detection accuracy, reaching 97.1% on images generated by 22 differ- ent generative models. It demonstrates strong generalization capabilities and computational efficiency, outperforming existing approaches on high-quality synthetic datasets. Our contributions include novel artifact representation approach and the introduction of the Synthetic-Pop dataset.
Limitations and Future Work. While the proposed method demonstrates robust performance, its effectiveness against compression-aleered synthetic images has yet to be fully explored. Future work will focus on improving detection of compression-alters images and extending the approach to address challenges posed by emerging forms of synthetic media.
10

---

Acknowledgements
This work was supported in part by the National Natural Science Foundation China (No. 62377028), the Guangdong Basic and Applied Basic Research Foundation (No. 2023B1515 120664), 150664)) the Sci- ence and Technology Program Project of the State Administration for Market Regulation (No. 2024MK097), the Science and Technology Planning Project of Guangdong (Nos. 2023A0505030013 and 2025A0505000018) the Fundamental Research Funds for the Central Universities (No. 21625102), and the Master Mentor Plan of Jinan University (No. YDXS2501).
References
[1] Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale gan training for high fidelity natural image synthesis. In International Conference on Learning Representations, 2018.
[2] Siyuan Cheng, Lingjuan Lyu, Zhenting Wang, Xiangyu Zhang, and Vikash Sehwag. Co-spy: Combining semantic and pixel features to detect synthetic images by ai. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 13455-13466 2025.
[3] Yunjey Choi, Minje Choi, Munyoung Kim, Jung- Woo Ha, Sunghun Kim, and Jaegul Choo. Stargan: Unified generative adversarial networks for multi-domain image-to-image translation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 8789-8797, 2018
[4] François Chollet. Xception: Deep learning with depthwise separable convolutions. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 1251-1258, 2017.
[5] Hyungjin Chung, Jeongsol Kim, Geon Yeong Park, Hyelin Nam, and Jong Chul Ye. Cfg++: Manifold-constrained classifier free guidance for diffusion models. CoRR, abs/2406.08070, 2024.
[6] dataautogpt3, Proteus VO.3.
2024.
[7] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34:8780-8794, 2021.
[8] Ricard Durall, Margret Keuper, and Janis Keuper. Watch your up-convolution: Cnn based generative deep neural networks are failing to reproduce spectral distributions. CVPR, pages 7890-7899, 2020.
[9] Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, al. Scaling rectified flow transform- ers for high- nigh-resolution image synthesis. In Forty-first International Conference on Machine Learning, 2024.
[10] Joel Frank, Thorsten Eisenhofer, Lea Schönherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. In International confer- machine learning, pages 2247-3255 PMLR, 2020.
[11] Shuyang Gu, Dong Chen, Jianmin Bao, Fang Wen, Bo Zhang, Dongdong Chen, Lu Yuan, and Baining Guo. Vector quantized diffusion model for text-to-image synthesis. In CVPR, pages 10696-10706. 2022.
[12] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and paltern recognition, pages 770-778, 2016.
[13] Yang He, Ning Yu, Margret Keuper, and Mario Fritz. Beyond the spectrum: Detecting deepfakes via re-synthesis. arXiv preprint 1435: 2021.

---

[14] Tianyang Hu, Fei Chen, Haonan Wang, Jiawei Li, Wenjia Wang, Jiacheng Sun, and Zhenguo Li. Complexity matters: Rethinking the latent space for generative modeling. Advances Neural Information Processing Systems, (8:29558-295777 2023.
[15] Sergey loffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International conference on machine learning, pages 148-456. pmlr, 2015.
[16] Yonghyun Jeong, Doyeon Kim, Seungjai Min, Seongho Joe, Youngjune Gwon, and Jongwon Choi. Bihpf: Bilateral high-pass filters for robust deepfake detection. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 48-57, 2022.
[17] Yonghyun Jeong, Doyeon Kim, Youngmin Ro, and Jongwon Choi. Frepgan: Robust deepfake detection using frequency-level perturbations. Proceedings of the AAAI Conference on Artificial Intelligence, 36( (661):00601106. Jun. 2022. doi: 10. 1609/aaai w36ia.l...361.... v3611.19990. URL https
//ojs. //ojs.aaai.co wwaai..rrgaa index. httpa//pppppaaAaaaraaaaaaaaaaaaa
[18] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for im- proved quality, stability, and variation. In International Conference on Learning Representations, 2018.
[19] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for im- proved quality, stability, and variation. In International Conference on Learning Representations, 2018.
[20] Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In CVPR, pages 4401-4410, 2019.
[21] Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 81 8110-81 81 19, 2020.
[22] Tero Karras, Miika Aittala, Samuli Laine, Erik Härkönen, Janne Hellsten, Jaakko Lehtinen. and Timo Aila. Alias-free free generative adversarial networks. Advances in neural information processing systems, 34:852 863, 2021.
[23] Diederik P Kingma and Max Welling. Auto-encoding variational bayes, 2022. URL https
/ //arxiv. org/ ab///
[24] Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang. Yao Hu, and Fuli Feng. Improving synthetic image detection towards generalization: An image transformation perspective. In Proceedings of the st ACM SIGKDD Conference on Knowledge Discovery and Data Mining I, pages 2405-2414, 2025.
[25] Tsung-Y Yi Lin, Michael Maire, Serge Belongic. James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 12, 2014, Proceedings, Part V 13, pages 740-755. Springer, 2014.
[26] Chi Liu, Tianqing Zhu, Sheng Shen, and Wanlei Zhou. Towards robust gan-generated image detection: multi-view completion representation. arXiv preprint arXiv:2306.013666 2023.
[27] Huan Liu, Zichang Tan, Chuangchuang Tan, Yunchao Wei, Jingdong Wang, and Yao Zhao. Forgery-aware adaptive transformer for generalizable synthetic image detection. In CVPR, pages 10770-10780. 2024.
(28) Luping Liu, Yi Ren, Zhijie Lin, and Zhou Zhao. Pseudo numerical methods for diffusion models manifolds. In International Conference on Learning Representations, 2022. URL https://openreviee wttp:e//oooummmtttiiiaaaaaa
[29] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pages 3730-3738, 2015.
12

---

[30] Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob Megrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image genera- tion and editing with text-guided diffusion models. In International Conference Machine Learning, pages 16784-16804. PMIR, 2022.
[31] Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detectors that generalize across generative models. In CVPR, pages 24480-24489, 2023.
[32] Taesung Park, Ming- Yu Liu, Ting-Chun Wang, and Jun- Yan Zhu. Semantic image synthesis with ppatially-adaptivy normalization. In CVPR, pages 2337-2344 2019.
[33] William Peebles and Saining Xie. Scalable diffusion models with transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4195-4205, 2023.
[34] Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. SDXL: Improving latent diffusion models for nigh-resolution image synthesis. In The Twelfth International Conference on Learning Representations, 2024.
URL httptttt//peerreeeea/e wwt.riiiwwweeeetonnieeeee httpe//ooruumndddd152228----
[35] John David Pressman, Katherine Crowson, and Simulacra Captions Contributors. Simulacra aesthetic captions. Technical Report Version 1.0, Stability AI, 2022. https://github. com/
http://mmlacraaaassseee........ captions
[36] PromptHero. Openjourney. https://oppejounne
art/ 2023.
[37] Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by mining frequency-aware clues. European conference on computer vision, pages 86 603103. Springer, 2020.
[38] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference machine learning. pages 8748 8763.773..766 PMLR, 2021.
[39] Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In International conference on machine learming, pages 8821-8831. Pmlr, 2021.
[40] Ali Razavi, Aaron van den Oord, Ben Poole, and Oriol Vinyals. Preventing posterior collapse with delta- VAFs. In International Conference on Learning Representations, 2019.
[41] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In CVPR, pages 10684-10695, 2022.
[42] Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. Medical image computing and computer-assisted intervention- 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings. part III 18, pages
Springer, 2015.
[43] Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner. Faceforensicst+:: Learning to detect manipulated facial images. In Proceedings of the IEEE/CVF international conference on computer vision, pages 1-11, 2019.
[44] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma. Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International janttinnanoounnall of computer vision, 1 15:2111222,, 2015.
[45] Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, et Laion- 5b: An open large-scale dataset for training next generation image-text models. Advances in Neural Information Processing Systems, 35:25278 22229427222994, 2022.
[46] SG161222. RealVisXI. V4.0.
http:/facccccccc1122.. RealeRallllllaaa VisXL_ V4.0
2024.
13

---

[47] Zenan Shi, Haipeng Chen, Long Chen, and Dong Zhang, Discrepancy-guus guided reconstruction learning for image forgery detection. arXiv preprint arXiv:2304. 13349, 2023.
[48] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, and Yunchao Wei. Learning on gradients: Generalized artifacts representation for gan-generated images detection. In CVPR, pages 12105 -11144, 2023.
[49] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Frequency-avve aware deepfake detection: Improving generalizability through frequency space domain learning. Proceedings of the AAAI Conference on Artificial Intelligence, 38(5):0052-
5060, Mar. 2024, doi: 10. 1609/a9aaaii v38i5.28310.
[50] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethink- ing the sampligg operations in enn-based generative network for generalizable deepfake detection. CVPR, pages 28130-281 2--002219,, 2024.
[51] Sheng- Yu Wang, Oliver Wang. Richard Zhang, Andrew Owens, and Alexei Efros. Con- generated images are surprisingly easy to spot... for now. In CVPR, pages 8695-8704, 2020.
[52] Zhendong Wang. Jiammin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and diffusion-generated
Houqiang Li. Dire for diffusion generated image detection. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages 22445-22455, 2023.
[53] Jonas Wulff and Antonio Torralba. Improving inversion and generation diversity in stylegan using a gaussianized latent space. arXiv preprint arXiv:2009.06522 2020.
[54] Jingfeng Yao, Cheng Wang. Wenyu Liu, and Xinggang Wang. Fasterdit: Towards faster diffusion transformers training without architecture modification. Advances in Neural Information Processing Systems, 37:561 66-56189, 2024.
[55] Yntec. YiffyMix V31. https://huggingfeet http://ggaaaacccoo////eeeaae co/Yntec/ViffyMin http:////uggiiiacc..oo//////e///
2023.
[56] Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint /rxiv:/506.000 03006, 2015.
[57] Zikai Zhou, Shitong Shao, Lichen Bai, Zhiqiang Xu, Bo Han, and 7eke Xie. Golden noise for diffusion models: A learning framework. arXiv preprint arXiv:2411.09500 2024.
[58] Jun Yan Zhu, Taesung Park, Phillip Isola, and Alexei A Efros. Unpaired image-to-imes translation using cycle-consistent adversarial networks. Proceedings of the IEEE international conference on computer vixion, pages 2223-2233 2017.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main contributions of this paper are clearly presented in the Abstract and Introduction, and are also summarized at the end of the Introduction section.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We did.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model sell-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
15

---

Justification:
There are no theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: All relevant experimental details are provided, and the data along with the code will be released GitHub after the paper is published.
Guidelines:
The answer NA means that the paper does include experiments. If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
16

---

Answer:
[Yes]
Justification: If the paper is accepted, the abstract in the final submitted version will include link the project.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cm ec/
for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https htt.SSbbbiiiiooooiiiiiooooi for more details.
//nips.cc/ppp wwwppcblccgguiecuceccccceooooope wet.ggddddee/eeebbininnn
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
See Subsection 5.1 and 5.2.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We did.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
17

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: See Subsection 5.2.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
This work conforms with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We did.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
18

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e-g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI...
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g.. pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
The paper does not involve the release of data models with high risk of misuse. Although the dataset includes synthetic images generated from COCO captions using diffusion models, these images intended solely for research synthetic image detection. The data contains no real human faces or personal information, and poses minimal risk of harmful dual use.
Justification:
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual- use should be released with necessary safeguards to allow for controlled use of the model, for example requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We did.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in package should be provided. For popular datasets, paperswithcone com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
19

---

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
We will provide the documentation along with the new assets in project
page.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: This work does not involve human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This work does not involve human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
20

---

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods in this research? Note that the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: We didn't.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non standaad components.
Please refer to our LLM policy for what should or should not be described.
21

---

Appendix
A Details of Synthetic-Pop
To evaluate the practicality of method across mainstream generated models, construct benchmark named Synthetic-Popp which includes six widely used models: Openjourney [36],
Proteus-0.3 [6]. RealVisXL-4N. [46]. SD-3.5-Medium [9. SDXL-Turbo [4], and YiffyMix [55].
Images are generated using 5,000 captions randomly sampled from COCO [25), following the
inference configurations recommended by each model. Representative examples are shown in
Figure
Openjoumey: A bench sitting the beach the ocean.
Proteus-O.3: A brown white and black dog is laying on gray couch.
RealVisXXL-4.0- A that has glasses and hat.
SD-3.5-Medium: Two stuffed animals a table with honey.
SDXI Cat sitting up with fake tie around its neck.
YiffyMix: A woman walking down a street talking cell phone.
Figure 4: Examples of images generated by different models along with their corresponding text prompts. Each subfigure presents an image produced by a specific model, where the format "Model: Prompt" denotes the generating model and its input description.
B
Visualization Analysis
B.1
Success Case Analysis
The effectiveness of LPD in distinguishing synthetic from real images stems from its ability to exploit intrinsic discrepancies in their local statistical structures. First, LPD captures subtle but systematic deviations introduced during generative process. Although synthetic images may appear perceptually indistinguishable from real images, their micro-texture distributions and noise characteristics deviate from the stochastic sensor noise inherent to real image acquisition. As illustrated in the second and fifth rows of Figure 5 real images retain structured yet naturally
22

---

Real
LPD
CAM
Fake
LPD
CAM
Figure 5: LPD and Grad-CAM visualizations of and fake images.
irregular noise patterns, whereas synthetic counterparts exhibit overly smooth regions artificial regularities-2 direct consequence of the generative model's learned priors.
Second, LPD operates in content-agnostie manner. It consistently reveals statistical inconsistencies across diverse semantic domains, including human portraits, wildlife, and landscapes. This invariance to semantic content highlights the signal-level nature of LPD, ensuring robustness against the rapid evolution of generative models that continue to enhance perceptual fidelity but still leave detectable low-level statistical artifacts.
Finally, the Grad- CMM visualizations in the third and sixth rows confirm that the model's attention aligns closely with LPD activation regions. Rather than focusing semantic objects, FerretNet concentrates on areas exhibiting statistical anomalies, enabling consistent detection across diverse image categories. This strong alignment between LPD and Grad-CAM underpins the discriminative strength of our approach: the network remains nearly silent on authentic images while responding sharply to synthetic ones.
23

---

Figure 6: LPD and Grad-CAM visualizations of False Positive Case.
Figure 7: LPD and Grad-CAM visualizations of False Negative Case.
B.2 Failure Case Analysis
False Positive Case. Figure 6 illustrates representative real images mistakenly classified as synthetic. Unlike the clear statistical distinctions observed in successful detections, these cases demonstrate that certain real-world textures exhibit statistical patterns similar those introduced by generative models.
In the first row, geological landscapes display highly regular and repetitive patterns, such as stratified rock formations with sharp color transitions and well-structured edges. These natural textures lead the LPD to capture statistical irregularities that resemble those typically found in generated content, particularly around boundary regions.
In the second row, the image of a bear grassland demonstrates a similar issue. The network has learned to associate strong, structured statistical biases as primary indicators of artificial generation, resulting in misclassification. This reflects the model's high sensitivity to subtle statistical cues, while also highlighting its limitations when encountering rare real-world scenes that are themselves highly structured "outliers."
24

---

False Negative Case. Figure 7 illustrates representative synthetic images that were mistakenly classified as real. These cases reveal two distinct mechanisms by which Al-generated content can evade detection, highlighting limitations of LPID-based approaches.
In the synthetic cow image, the LPD map correctly highlights widespread, high-energy artifacts. Here, the failure is not in feature detection but in decision aggregation: the network sums all detected artifact signals compute final "fakeness" score. In this instance, despite numerous detected artifacts, their combined contribution did not exceed the threshold for a "fake" classification. This represents a rare boundary-case where state-of-the-ae generator produces content lying precisely on the "real" side of the learned decision boundary.
In contrast, the synthetic giraffe image exhibits a fundamentally different failure mode. Although Grad-CAM shows activation in textured regions, the overall signal weak and insufficient for confident classification. A major factor is the clean, homogeneous sky background, which occupies large portion the image. Such smooth, featureless regions lack the local pattern variations necessary for LPD detect pixel discontinuities or unnatural transitions. Consequently, the model receives insufficient discriminative signal, leading to misclassification.
C
Additional Experiments
C.1
Scaling FerretNet
We scaled our model down (FerretNet-S) and up (FerretNet-L, 20x parameters). As shown in Table 9 making the model significantly larger results in slight performance degradation. This confirms our hypothesis that for detecting low-level statistical artifacts, larger networks are prone to overfitting to teiiniggsppecife patterns, which harms generalization. Our proposed FerretNet hits the "sweet spot" of being sufficiently expressive without the excess capacity.
Table 9: Ablation on scaling FerretNet. Results are mean ACC/AP across all test sets.
Method
Channels
Blocks
Parameters
Mean ACC/ / AP
FerretNet-S
(32, 64)
(2, 2)
0.13 M
93.1 997.6
FerretNet-B
(96, 192)
(2, 2)
1.06 M
97.1 99.6
FerretNet-L.
(96, 192, 384, 768)
(2, 2, 6,
21.51 M
96.6 / 99.4
C.2 Robustness to Common Post-Processing
We conducted comprehensive robustness analysis on the ForenSynths [51) test set against JPEG compression, resizing, and rotation. For resizing, we used a stringent protocol with dynamic resolutions. As shown in Table TO, FerretNet demonstrates strong robustness, particularly against rotation, where it significantly outperforms the heavyweight FatFormer (27]. This provides strong evidence that LPD features, being based on local, iientation-agnosse statistics, are inherently immune to geometric transformations. While heavy JPEG compression remains a challenge for all lightweight detectors, FerretNet performs competitively.
Table 10: Robustness analysis on the ForenSynths test set against common post- proccessnns attacks.
JPEG
Resize
Rotation D=[-45%, 45%]
Method
No Attack
(Q=100)
(Q=75)
(S=0.75)
(S=1.25)
Net 49
91.5/98.5
50.5/66.6
50.1/51.8
65.2/85.8
64.9/82.8
79.9/91.6
NPR 50
92.5/96.1
55,0/59.3
50.0/49.
83.9/84.9
78.9/81.8
86.7/90.7
FatFormer 27
98.4/99.7
96.5/99.4
71.7/89.8
68.1/96.8
FerretNet (Ours)
95.9/99.3
55.1/67.8
50.2/49.4
81.4/94.3
80.8/95.4
88.2/98.0
25


Reviews:
[{"review_id": "ZswswnxLlD", "reviewer": "Reviewer_H5Hq", "summary": "This paper proposes FerretNet, a lightweight method for detecting synthetic images by exploiting artifacts from generative models. The authors identify two artifact sources (i.e., latent distribution deviations and decoding-induced smoothing). They introduce Local Pixel Dependencies (LPD), a median-based reconstruction strategy rooted in Markov Random Fields, to capture texture, edge, and color inconsistencies. FerretNet uses depth-wise separable and dilated convolutions to process LPD features. Trained on 4-class ProGAN data, FerretNet achieves 97.1% accuracy across 22 generative models in an open-world benchmark, outperforming SOTA by 10.6%.", "questions": "1. The proposed method is based on the assumption that the image generation pipeline incorporates a latent space along with a decoder. While most contemporary image generation techniques utilize an encoder-decoder design to facilitate higher resolution training, some methods do not encode images into a latent space. Examples of such methods include vanilla DDPM and AR approaches. How would the proposed method perform in comparison to these types of methods that do not align with this assumption?\n\n2. Are there differences in how the proposed method detects diffusion-based and AR-based generative images? This includes the differences in the LPD features and the detection performances. Incorporating such comparisons enhances our understanding of the usability of the proposed method and the contributions to the generation community.\n\n3. In relation to the second weakness identified, Figure 2 illustrates the patterns of the proposed LPD maps. I am curious if there is a distinguishing \"signature\" that differentiates real images from synthetic ones. Providing clear examples (e.g., they could possibly be zoomed-in sections of edge or texture regions) could enhance the interpretability of the decisions made by the proposed method.", "limitations": "Yes. The paper discusses limitations regarding the effectiveness of compression-altered synthetic images and suggests improvements for detecting these altered images.\n\nNo potential negative societal impact is provided.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "**Strength**:\n\n1. This paper presents a well-structured methodology that proposes an effective cue LPD for detecting synthetic images, including visualization and comprehensive ablation studies to validate the design.\n\n2. The proposed method exhibits strong cross-model generalization ability with an accuracy of 97.1% across 22 generators and demonstrates high efficiency of 772 FPS on a single card, making it suitable for real-world deployment.\n\n\n\n**Weaknesses**:\n\n1. The proposed method is trained exclusively on the 4-class data set from ProGAN, which includes cars, cats, chairs, and horses. This training approach limits exposure to the diverse artifacts typically produced by diffusion models. As a result, the performance of FerretNet shows a notable decline when evaluated against diffusion models. For instance, it achieves an accuracy of 91.4% on DALL-E (as shown in Table 2), compared to 98.8% for the SOTA method.\n\n2. Although Figure 2 clearly shows the discontinuities in the LPD, the paper does not provide intuitive interpretations of how the LPD map influences the final decision. Additionally, it lacks visual examples of the LPD maps near the decision boundaries, as well as instances of true negatives and false positives.\n\n3. The quantitative results reported in Section 5.3 on three different test sets use unaligned comparison methods: 9 on ForenSynth, 7 on Diffusion-6-cls, and 3 on Synthetic-Pop. This raises concerns about fairness in the comparisons.\n\n4. There are several missing citations and comparison methods (if applicable):\n\n[1] CO-SPY: Combining Semantic and Pixel Features to Detect Synthetic Images by AI, CVPR 2025.\n\n[2] Orthogonal Subspace Decomposition for Generalizable AI-Generated Image Detection, ICML 2025.\n\n[3] Detect Fake with Fake: Leveraging Synthetic Data-driven Representation for Synthetic Image Detection, ECCV 2024.\n\n[4] Improving Synthetic Image Detection Towards Generalization: An Image Transformation Perspective, KDD 2025.", "was_revised": true, "final_justification": "My concerns have been addressed through the rebuttal and discussions. I believe the paper is technically sound, considering the explanations and additional results provided during the discussions. Therefore, I am inclined to accept this paper.\n\nHowever, the authors should include the additional comparisons, analyses, and visualizations mentioned in the discussion in the final version, if the paper is accepted.", "rebuttal": "Dear Reviewer,\n\nThank you for your detailed and insightful review of our work. Your thoughtful comments are invaluable for improving the quality of our paper. We have carefully considered each of your points and have provided clarifications and new experimental results accordingly. We hope that our response adequately addresses your concerns.\n\n#### **1. Regarding Training on ProGAN and Performance on Diffusion Models (Weakness 1)**\n\nWe appreciate the reviewer's focus on this point, as it touches upon the core philosophy of our work.\n\n*   **Intentional Experimental Design:** Our experimental setup was **by design**. We aimed to simulate a challenging and realistic scenario: training a lightweight model on a limited, known source of artifacts (ProGAN) to test its ability to generalize to unseen generators with entirely different artifact patterns (like diffusion models). This follows the stringent \"Train on One, Test on Many\" evaluation paradigm in the field of universal forgery detection, which is designed to assess a model's **\"zero-shot\" generalization capability**.\n\n*   **Performance vs. Efficiency Trade-off:** We acknowledge the accuracy gap with the SOTA method, FatFormer, on DALL-E. However, we wish to highlight the context and significance of our result:\n    *   **Extreme Efficiency:** Our FerretNet has only **1.1M** parameters, which is approximately **0.2%** of FatFormer's size (577.3M). Furthermore, our method requires no large-scale pre-training. In contrast, FatFormer is a modified version of CLIP and relies on costly pre-training on large-scale datasets.\n    *   **Excellent Generalization:** Despite this massive efficiency advantage, our model still achieves a high accuracy of **91.4%** on the completely unseen DALL-E dataset, significantly outperforming most baseline methods.\n\nTherefore, our central contribution is not to surpass the SOTA accuracy on a specific dataset but to achieve an **unprecedented and exceptional balance between computational cost, deployment efficiency, and cross-generator generalization ability**. This makes our method highly valuable for practical, resource-constrained applications, which we believe is a significant contribution.\n\n#### **2. Regarding Applicability to Non-\"Latent Space-Decoder\" Architectures (Question 1)**\n\nThis is a very insightful question that gets to the heart of generative model diversity.\n\n*   **Universality of the Core Mechanism:** The \"latent space + decoder\" framework used in Section 3 of our paper serves as an accessible abstraction for mainstream generators. However, our core module, **LPD (Latent-artifact-based Pseudocode Detection), is not fundamentally dependent on the existence of an explicit latent space**. The essence of LPD is to **capture local inconsistencies in the pixel domain** that arise from any process of \"up-sampling\" or \"generation.\" Whether it's a GAN decoding from a low-dimensional vector, a DDPM progressively denoising to create high-frequency details, or an autoregressive (AR) model making pixel-by-pixel (patch by patch) predictions, the process inevitably introduces local artifacts that do not conform to the statistical properties of natural images. LPD is designed to detect precisely these subtle, process-induced flaws.\n\n*   **New Experimental Verification:** To robustly demonstrate the universality of LPD, we have conducted **new experiments** as you suggested on two models that do not strictly follow the classic \"latent space-decoder\" paradigm: the AR-based model **VAR** [1] and a vanilla **DDPM**. Each test set contains 500 synthetic and 500 real images (DDPM images from DIRE [2], VAR images generated by us). We evaluated our FerretNet, trained only on ProGAN, against them. The results are as follows:\n\n| Method | VAR | DDPM |\n| :--- | :---: | :---: |\n| | ACC / AP | ACC / AP |\n| NPR | 82.9 / 83.7 | 99.2 / 100.0 |\n| Freq | 95.3 / 98.7 | 87.7 / 99.9 |\n| FatFormer | 83.9 / 91.1 | 57.0 / 86.5 |\n| **FerretNet (Ours)** | **97.8 / 99.9** | **99.7 / 100.0** |\n\n**Conclusion:** The results clearly show that **FerretNet achieves the best performance on both AR and DDPM models**, even significantly outperforming the heavyweight FatFormer. This strongly supports our claim that the local pixel-domain inconsistencies captured by LPD are a **more fundamental and universal type of artifact feature**, which generalizes exceptionally well to unseen generators with diverse artifact patterns. We will add this experiment and a corresponding analysis to the final version of our paper.  \n  [1] Visual autoregressive modeling: Scalable image generation via next-scale prediction, NeurIPS 2024.  \n[2] Dire for diffusion-generated image detection, CVPR 2023.\n\n#### **3. Regarding LPD Interpretability and Visualization (Weakness 2 & Question 2, 3)**\n\nWe wholeheartedly agree that enhancing interpretability is crucial for understanding our method.\n\n*   **The \"Signature\" of LPD Artifacts:** As the reviewer astutely observed, LPD does reveal a distinct artifact \"signature.\" As shown in Figure 2 of our main paper:\n    *   The LPD maps of **real images** typically present as **uniform, low-energy, noise-like textures**, reflecting the local smoothness and consistency of natural scenes.\n    *   The LPD maps of **synthetic images** expose **high-energy, structural artifacts**, such as **bright lines, grids, or patches**, especially along object edges, on smooth surfaces (like skin), or in complex textures. These are the unnatural traces left by the generative model as it \"invents\" details.\n\n*   **Commitment to Add Visualization Analysis in Final Version:** To more intuitively demonstrate how LPD influences the final decision and to address your concerns about decision boundaries and misclassifications, we **commit to adding a new, dedicated section for visualization analysis in the appendix of the camera-ready version**. This section will include:\n    *   **Typical successful cases:** Side-by-side comparisons of real/fake image patches, their corresponding LPD maps, and heatmaps to clearly showcase the artifact \"signatures.\"\n    *   **Decision boundary cases:** Examples where the artifact signals in the LPD maps are weak, making them challenging for the model.\n    *   **Failure case analysis:** Examples of **false positives** (real images misclassified, perhaps due to strong natural periodic patterns) and **false negatives** (undetected fakes, perhaps with very subtle artifacts) to provide a deeper insight into the limitations of our method.\n\nWe believe these additions will greatly enhance the paper's interpretability and completeness.\n\n#### **4. Regarding Unaligned Comparison Methods (Weakness 3)**\n\nWe understand the reviewer's concern about the fairness of comparisons. We would like to clarify that our comparison strategy **strictly adheres to established and recognized evaluation benchmarks and protocols within the field**.\n\n*   **Following Established Protocols:** As mentioned in Section 5.1.1, our experimental setup follows the protocols established in prior works.\n*   **Evolution of Benchmarks:** The benchmarks ForenSynths, Diffusion-6-cls, and Synthetic-Pop were introduced at different times to evaluate the then state-of-the-art (SOTA) or most representative methods. For instance, when FatFormer was evaluated for its generalization to diffusion models, it was compared against methods like DIRE and Ojha et al. on the Diffusion-6-cls benchmark. Therefore, our use of these same comparison methods on each benchmark is a standard academic practice to ensure **direct and fair comparability** with those foundational works.\n*   **Improving Clarity:** To make this rationale clearer to readers, we **will add a sentence in the experimental section of the final version to explicitly explain the basis for selecting comparison methods** for each benchmark.\n\n#### **5. Regarding Missing Citations (Weakness 4)**\n\nThank you very much for pointing out these highly relevant and recent papers! We have carefully reviewed them.\n\n*   **Commitment to Update:** We **will incorporate a detailed discussion of these four papers [1-4] in the \"Related Work\" section of the final version**, analyzing their connections and differences with our work.\n*   **Regarding Experimental Comparison:** Given the limited rebuttal period, a full and fair reproduction and comparison against these very recent methods is not feasible. However, **we commit to checking for publicly available code for these methods while preparing the camera-ready version. If feasible, we will do our best to include them in our benchmark tests** to provide an even more comprehensive evaluation.\n\n#### **6. Regarding Other Issues (Societal Impact and Table Format)**\n\n*   **Societal Impact:** Thank you for the reminder. We will add a \"Broader Impact / Limitations\" section in the final manuscript. We will state that while our work aims to be defensive, any detection method can potentially be used by attackers to evaluate the \"undetectability\" of their models, thus contributing to a technological \"arms race.\"\n*   **Table Format:** We apologize for the reduced readability of Tables 1 and 2, which were transposed due to page limitations. In the final version, we will **prioritize readability and make every effort to reformat these tables** to be more intuitive."}, {"review_id": "ZldaKpcjKA", "reviewer": "Reviewer_GWiN", "summary": "The paper targets on the task of detecting if a image is a real image or a machine generated one. It utilize a very simple approach -- compute the difference of the image with it's median filtered version. A light classification network with small perfective field is trained with the input of this difference pixel map, to decide if the image is fake or real. Substantial experiments are conducted with generated images from various models including GANs and Diffusion Models. The comparison with existing works shows that this paper if more effective on detecting the generated image using a much smaller network.", "questions": "Would be nice if you could make a clear connection between the analysis in Section 3 and the proposed method in Section 4. If not I would suggest to move section 3 to appendix or later in the paper as an independent discussion. In its current form it feels like the motivation of the method exists in Section 3 but I couldn't get it.\n\nThe ablation on the FerretNet might worth to revisit. I can see the reason that a light weight shallow network works well because of limited receptive field. But I can't see why a deeper network works worse other than overfitting. If would be nice to analyze this more and show why.", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1/ The paper is easy to follow. The idea is simple and light weighted. It is pretty surprising that such a simple method could beat many existing approaches. \n\n2/ The ablation experiments are well designed. It carefully compared different design choices. The ablation on the receptive field is especially helpful. The large margin in this ablation is a bit surprising, which might reveal the core of the approach -- local neighbor is all that matters.\n\n3/ I like the analysis itself in Section 3 about the sources of the artifacts for generated images. Though it does not seem to tightly related to the method design with median filter etc. \n\nWeakness:\n\nThe author claims the proposed FerretNet is novel because “it adopts a dual-path parallel architecture to increase the receptive field”. However this concept has existed long way back to the GoogleNet (prefer wide over depth in deep neural networks), and since then there has been a lot of variations of GoogleNet. Therefore I’m not sure if the proposed FerretNet is either novel or necessary. Although authors provide an ablation on FerretNet by comparing it to Xception and ResNet50, it is not quite convincing to me because it is very possible to the worse performance on Xception/Resnet50 is because they are overfitting the training data with 20x more parameters than proposed FerretNet. I’m very curious to see if you make FerretNet larger (e.g., 20x larger), if the performance will get better or worse.", "was_revised": true, "final_justification": "All my concerns have been resolved through the communication with the authors. I'm happy that the authors are willing to take my suggestions on revising how to better present their techniques. The paper itself provides a simple yet effective approach which is neat so I would recommend for acceptance.", "rebuttal": "Dear Reviewer,\n\nThank you for your constructive feedback and for appreciating the simplicity, effectiveness, and well-designed ablation studies of our work. Your insightful questions have helped us to further probe the core principles of our method and clarify our contributions. We are pleased to provide the following responses and new experimental results.\n\n#### **1. Clarifying the Architectural Contribution of FerretNet**\n\nThank you for this insightful question, which gives us the opportunity to precisely define our architectural contribution.\n\n*   **Clarifying our Contribution:** We agree that the general concept of multi-branch architectures for expanding receptive fields, such as in GoogLeNet, is well-established. The key novelty of FerretNet, therefore, lies not in inventing the multi-branch paradigm itself, but in the **principled and highly-specialized architectural engineering** for a unique task: detecting subtle artifacts from LPD feature maps. Our contribution is a demonstration of how a carefully co-designed set of lightweight components (depthwise separable, grouped, and dilated convolutions) can create an extremely efficient yet powerful feature extractor for this specific type of low-level signal—a problem for which, as we show, standard deep networks are ill-suited.\n\n*   **New Experiment on Scaling FerretNet:** To directly address your insightful question, *\"if you make FerretNet larger (e.g., 20x larger), if the performance will get better or worse,\"* we conducted a new set of experiments by scaling our model up and down. We report the average results across the ForenSynths, Diffusion-6-cls, Synthetic-Pop, and Synthetic-Aesthetic test sets.\n\n| Method | Channels | Blocks | Parameters | ACC / AP |\n| :--- | :--- | :--- | :--- | :---: |\n| FerretNet-S | (32, 64) | (2, 2) | 0.13 M | 93.1 / 97.6 |\n| **FerretNet-B (Ours)** | (96, 192) | (2, 2) | **1.06 M** | **97.1 / 99.6** |\n| FerretNet-L | (96, 192, 384, 768) | (2, 2, 6, 2) | 21.51 M | 96.6 / 99.4 |\n\n*   **Analysis and Conclusion:** These results provide a clear answer and strongly support your intuition.\n    *   Making the model significantly larger (FerretNet-L, ~20x parameters) results in a slight **performance degradation**.\n    *   This confirms your hypothesis that **overfitting is the primary reason why deeper, larger networks like Xception/ResNet50 (and even a bloated FerretNet-L) perform worse**. Our detection task relies on identifying subtle, low-level, local statistical artifacts present in the LPD maps. These maps are more akin to residual signals than semantic images.\n    *   Large, deep networks are designed to learn high-level semantic features. When applied to LPD maps, they are prone to overfitting to spurious correlations or specific artifact patterns from the training generator (ProGAN), which ultimately **harms their generalization ability** to unseen artifacts. Our proposed FerretNet-B hits the \"sweet spot,\" being sufficiently expressive to capture the necessary features without having the excess capacity that leads to overfitting.\n\nWe will incorporate this new ablation study and the accompanying analysis into the final version of the paper, as it provides a much stronger justification for our lightweight design.\n\n#### **2. Clarifying the Connection Between Section 3 (Artifact Analysis) and Section 4 (Method)**\n\nThank you for pointing out the need for a clearer link between these two sections. We apologize if the connection was not sufficiently explicit. The logical flow from our theoretical analysis to our method design is as follows:\n\n*   **Section 3 (The 'Why'):** This section establishes the fundamental reason *why* artifacts exist. We analyze how various generative models, despite their different architectures, share a common challenge: synthesizing high-frequency details from lower-dimensional information. This process inevitably leads to microscopic inconsistencies.\n\n*   **Section 4.1 (The 'What'):** This section proposes LPD as a tool to *quantify* these microscopic inconsistencies. Based on the assumption that natural images exhibit strong local pixel dependencies (a Markov Random Field property), LPD is designed to measure the breakdown of these dependencies. Thus, **LPD is the direct methodological response to the problem identified in Section 3.**\n\n*   **Section 4.2 (The 'How'):** This section designs FerretNet to *effectively analyze* the LPD maps generated in the previous step. As shown in our paper (e.g., Figure 2), the LPD artifacts are spatially non-uniform; their patterns and scales vary across the image. Therefore, a specialized network with **multiple receptive field branches (our FerretNet)** is required to capture these diverse, non-stationary artifact responses, from micro-local to meso-local scales.\n\nIn the final manuscript, we will revise the beginning of Section 4 to explicitly state this logical flow (Why -> What -> How) to ensure the motivation for our method is clear and well-connected to our analysis.\n\n---\n\nOnce again, we sincerely thank you for your sharp and constructive feedback, which has significantly helped us strengthen the paper. We hope our response and the new experiments have addressed your concerns."}, {"review_id": "qoXwA1xLXf", "reviewer": "Reviewer_rzrq", "summary": "The paper presents FerretNet, a lightweight convolutional network that detects synthetic images by exploiting local pixel dependencies (LPD) derived from Markov-Random-Field-motivated, zero-masked median deviations between each pixel and its neighborhood. The paper also provides a large-scale benchmark dataset, Synthetic-Pop, covering six cutting-edge generators. Extensive experiments show that the method is effective.", "questions": "1. Please report results on common post-processing (JPEG, resizing, rotating ...) as these are ubiquitous in social media.\n2. Please clarify the conceptual differences between FerretNet and NPR [1].\n3. Generative models could explicitly minimize median deviation artifacts. Please explain why we should not consider this adaptive threat model.\n\n\n[1] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethinking the up-sampling operations in CNN-based generative networks for generalizable deepfake detection. In CVPR 2024", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n1. The paper is easy to follow.\n2. The method is efficient.\n\nWeaknesses:\n\n1. No experiments on common post-processing (JPEG, resizing, rotating ...).\n2. The idea of locality-based cues is somewhat incremental. This makes the novelty limited.\n3. The authors should explore the adaptive attacks of this method.", "was_revised": true, "final_justification": "All my concerns have been addressed.", "rebuttal": "Dear Reviewer,\n\nThank you for your valuable feedback. We are pleased that you found our paper easy to follow and our method efficient. Your questions regarding post-processing robustness, novelty, and adaptive attacks are critical, and we are pleased to provide new experimental results and clarifications below.\n\n#### **1. Regarding Robustness to Common Post-Processing**\n\nThis is a critical point, as real-world images are rarely pristine. We fully agree and, as per your suggestion, have conducted a comprehensive robustness analysis on the ForenSynths test set against three of the most common post-processing operations: JPEG compression, image resizing, and rotation. The detailed ACC/AP results are as follows.\n\n*A note on the image resizing experiment:* For this test, we adopted a more stringent and realistic evaluation protocol. Instead of resizing all images to a fixed input size, as is common for batch processing, we fed the arbitrarily resized images (with dynamic resolutions) directly into the models. As FatFormer's architecture does not support dynamic resolutions, it was excluded from this specific test.\n\n| Method | No Attack | JPEG (Q=100) | JPEG (Q=75) | Resize (S=0.75) | Resize (S=1.25) | Rotation D=[-45°, 45°] |\n| :--- | :---: | :---: | :---: | :---: | :---: | :---: |\n| FreqNet | 91.5/98.5 | 50.5/66.6 | 50.1/51.8 | 65.2/85.8 | 64.9/82.8 | 79.9/91.6 |\n| NPR | 92.5/96.1 | 55.0/59.3 | 50.0/49.1 | 83.9/84.9 | 78.9/81.8 | 86.7/90.7 |\n| FatFormer | 98.4/99.7 | 96.5/99.4 | 71.7/89.8 | --- | --- | 68.1/96.8 |\n| **FerretNet** | **95.9/99.3** | **55.1/67.8** | **50.2/49.4** | **81.4/94.3** | **80.8/95.4** | **88.2/98.0** |\n\n**Analysis of Results:**\n\n*   **JPEG Compression:** As expected, heavy JPEG compression (Q=75) severely degrades artifact signals, causing a significant performance drop across all methods. We note that lightweight methods without large-scale pre-training (including our FerretNet) are more affected than FatFormer, which likely learned features more robust to compression from its massive pre-training dataset. This highlights a common challenge for all lightweight detectors.\n*   **Image Resizing:** In this more challenging dynamic-resolution test, our **FerretNet demonstrates strong robustness**, outperforming other lightweight methods in both down-sampling and up-sampling scenarios. This indicates that our method is not sensitive to scale changes.\n*   **Image Rotation:** In the rotation robustness test, **FerretNet achieves the best performance among all methods**, even significantly surpassing the heavyweight FatFormer. This result provides strong evidence for the superiority of our design: LPD features are based on local, orientation-agnostic statistical dependencies, not on fixed spatial or frequency patterns, making them inherently immune to geometric transformations like rotation.\n\nWe thank you for your valuable suggestion. This analysis is crucial for evaluating the practical potential of our method, and **we commit to including the full experimental details and the table in the appendix of the final version** for readers' reference.\n\n#### **2. Regarding Novelty: From \"Locality\" to \"Statistical Anomaly\"**\n\nWe understand your concern regarding the novelty of the \"locality\" concept. We wish to clarify that our core innovation is not simply \"using local cues,\" but **how we fundamentally model \"locality.\"**\n\nMany prior works rely on detecting **specific, heuristic-based local artifacts**, such as checkerboard patterns from GANs or specific frequency anomalies. This approach is akin to **\"pattern matching\"** and can lose effectiveness as generator models evolve and artifact patterns change.\n\nOur approach is philosophically different, shifting the detection paradigm from \"pattern matching\" to **\"statistical anomaly detection\"**:\n\n*   **A Principled Statistical Foundation:** Our LPD feature is built on a cornerstone of natural image statistics—the **Markov Random Field (MRF) assumption**. We do not hunt for any known artifact \"signatures.\" Instead, we measure the degree to which an image **violates the local pixel statistical dependencies** that should exist in a natural scene.\n*   **A Model-Agnostic Artifact Signal:** This method provides a model-agnostic and more universal artifact signal. Whether an artifact is caused by unnatural smoothness from a generator's decoder or an abrupt change from a diffusion denoising step, it will leave a trace at the local statistical level that LPD can capture.\n\nWe believe this **principled, universally applicable artifact modeling approach based on statistical foundations** represents a substantive contribution, not merely an incremental extension of locality-based ideas.\n\n#### **3. Conceptual Differences with NPR**\n\nThis is an excellent question that helps to precisely position our work. The difference can be summarized with an analogy:\n\n*   **NPR looks for the \"tool marks.\"** It focuses on detecting the fixed, high-frequency patterns, like \"fingerprints,\" left in an image by specific upsampling operations (e.g., nearest-neighbor interpolation). Its logic is: \"I found traces left by Tool A, therefore this image is a forgery.\"\n\n*   **LPD checks if the \"scene obeys the laws of physics.\"** It does not care what \"tool\" was used. It checks if the final result is statistically plausible. Its logic is: \"The distribution of pixels in this local region does not follow the statistical laws of the natural world, therefore it is a forgery.\" Whether the artifact was caused by upsampling, diffusion denoising, or some other unknown technique, LPD can detect the anomaly as long as it disrupts natural local statistics.\n\nIn short, NPR is **fingerprinting a specific cause**, while LPD is **detecting a universal effect**.\n\n#### **4. Regarding the Threat of Adaptive Attacks**\n\nThis is a very forward-thinking question. An adaptive attack, where a generator is trained to explicitly fool a detector, is the ultimate test of robustness.\n\n*   **The Generator's Dilemma:** While an attacker could theoretically add \"minimizing LPD artifacts\" as a loss term during training, this would place them in a dilemma. To completely eliminate LPD artifacts, the generator would need to perfectly replicate the extremely complex local statistics of natural images at the pixel level. This is an incredibly difficult optimization problem in itself. Forcing the model to do this would likely act as strong regularization that could **harm the overall image quality, diversity, or semantic coherence** of the generated images. The attacker must make a difficult trade-off between \"undetectability\" and \"image fidelity.\"\n\n*   **Raising the Bar for Attackers:** Our method essentially raises the bar for attacks. An attacker can no longer get away with patching a few superficial, specific artifacts; they must now solve a much more fundamental and difficult problem of statistical simulation.\n\n*   **Future Work:** We completely agree that this is a vital research direction. As a defense, we plan to explore and enhance our model's robustness in future work by incorporating LPD as part of a discriminator in an adversarial training loop."}, {"review_id": "psBaDsyoeN", "reviewer": "Reviewer_X1Vd", "summary": "The authors address the challenge of synthetic image detection by focusing on local pixel dependencies, observing that generative models often introduce subtle inconsistencies within small neighborhoods. To capture these artifacts, they compute the median value within a local context window for each pixel and measure the difference between the original image and this median-filtered version, generating a feature map that highlights local pixel dependencies. Their proposed model, FerretNet, is built using a series of Ferret Blocks that incorporate dilated and grouped convolutions to effectively capture multi-scale features. The approach is evaluated on images generated by both GANs and LDMs. To justify their architectural choices, the authors conduct ablation studies on the neighborhood window size, the treatment of the center pixel, the selection of the median operation, and the influence of different backbone networks.", "questions": "Q1) Lines 141–142 state that the model performs better with an even number of pixels, but this seems counterintuitive, especially since the neighborhoods used (e.g., 3×3, 5×5, 7×7) are all odd-sized. Could the authors clarify this claim?\n\nQ2) How is FerretNet trained? While the architecture and the LPD mechanism are described, the training loss function is not clearly specified.\n\nQ3) Were any of the evaluated methods VAEs? VAEs are referenced multiple times throughout the paper, but it's unclear whether they are included in the comparisons.\n\nQ4) What is the origin of the Synthetic-Aesthetic dataset? Is it a novel dataset introduced in this work, or does it come from prior literature?", "limitations": "yes", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 1, "clarity": 1, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Primary Justifications:\nMy negative assessment is primarily due to the lack of clarity in the methodology (see W1, W3–W6) and the unconvincing empirical results (see W8–W10).\n\nStrengths:\n\nS1) The ablation studies are comprehensive and provide strong justification for the proposed method.\n\nS2) The core idea of modeling local pixel dependencies is conceptually interesting and novel.\n\nWeaknesses:\n\nW1) While the introduction presents the Synthetic-Pop dataset as a contribution, the paper provides minimal detail about its curation, contents, or validation methodology.\n\nW2) The related work section lacks essential background on the foundational models, limiting the reader's ability to understand the context.\n\nW3) Figure 1 is unintuitive, overly verbose, and does not add meaningful insight.\n\nW4) The argument in Section 3.1 is unconvincing. It draws vague parallels between LDMs, GANs, and VAEs, despite significant conceptual differences in their latent spaces (e.g., dimensionality, inference steps). These connections are not rigorously justified. This section should either be substantially clarified or removed.\n\nW5) Line 134 references the MRF assumption without explaining why it is applicable in this context. This should be explicitly motivated and justified.\n\nW6) The training procedure for FerretNet is insufficiently described (see Q2 for more detail).\n\nW7) The Synthetic-Pop dataset appears to omit key SOTA models, such as FLUX.\n\nW8) Results in Table 1 are not competitive with SOTA; FatFormer outperforms the proposed FerretNet.\n\nW9) Table 2 shows only a marginal (~2%) average improvement on diffusion datasets, which is concerning given that FerretNet underperforms in Table 1.\n\nW10) If Synthetic-Pop is intended as a novel benchmark, its utility is questionable: performance exceeds 96%, suggesting the dataset may not be sufficiently challenging to provide value to the community.", "was_revised": true, "final_justification": "My primary concerns during the first review cycle centered on the lack of clarity in the writing and what I initially felt were unconvincing results.\n\nI now find the results of the main method to be convincing. While the method does not outperform SOTA approaches, it achieves comparable performance with significantly fewer parameters, which is a meaningful contribution.\n\nHowever, I still find several aspects of the paper unclearly presented and potentially misleading, particularly in relation to the proposed dataset (presented as 1/3 of the paper's contribution). The dataset is positioned as a major contribution early in the paper, but this is not adequately supported throughout. First, its usefulness appears limited: while it helps differentiate between existing methods, it is unlikely to serve as a valuable benchmark for future work due to saturation. Second, the dataset is not well-situated within the context of related work. Third, its overall presence and impact in the paper are minimal relative to its prominence in the introduction, leading to inconsistencies in how its significance is perceived. Fourth, due to technical limitations, the authors were unable to present results for the most recent SOTA models, which makes it difficult to understand how the proposed dataset fits within the context of the current literature.\n\nBeyond the dataset, other portions of the manuscript (such as certain figures and the section describing the underlying intuitions) also struck me as unclear or potentially misleading.\n\nFollowing a discussion with the authors, they have agreed to revise and clarify many of these areas. As a gesture of good faith in their commitment to improving the paper, I have increased my score from 2 to 3. That said, the extent of the unclear and potentially misleading content leads me to believe that **the revised version would still benefit from additional peer review focused on clarity**. For this reason, I am not comfortable raising my score further at this time.", "rebuttal": "Dear Reviewer,\n\nThank you for your detailed review. While we appreciate the time you have invested, we must respectfully state that we believe your overall negative assessment is based on several fundamental misunderstandings of our paper's content and a misinterpretation of our experimental results. We have identified numerous claims in your review that are factually inconsistent with the information presented in our manuscript.\n\nWe will address each of your points below, providing direct references to the paper to correct these inaccuracies.\n\n#### **1. Clarifications on Factual Misunderstandings in the Review**\n\nA significant portion of the negative evaluation stems from claims that are directly contradicted by the text of our paper.\n\n*   **Regarding W6 & Q2 (Missing Training Loss):** You state that the training loss function is not specified. This is incorrect. As clearly stated on **Page 6, Line 216**, *\"Binary Cross Entropy with Logits Loss (BCEWithLogitsLoss) is adopted as the loss function.\"* The entire training setup, including the optimizer, learning rate, and data augmentation, is detailed in **Section 5.2 (Lines 212-217)**.\n\n*   **Regarding Q4 (Source of Synthetic-Aesthetic Dataset):** You ask for the source of this dataset. This information is explicitly provided. On **Page 6, Lines 205-209**, we state that the images were *\"sampled from the Simulacra Aesthetic Captions (SAC) dataset\"* and the real images were from *\"LAION-Aesthetics V2\"*.\n\n*   **Regarding Q1 (Even vs. Odd Pixels):** You claim we state the model *\"performs better when the number of pixels is even,\"* which you find counter-intuitive. This is a significant misreading of our text. We never make this claim. On **Page 4, Lines 140-142**, we state our zero-masking strategy is *\"particularly beneficial when the neighborhood contains an even number of pixels.\"* This refers to the number of *neighboring pixels* used for the median calculation (e.g., a 3x3 window has 8 neighbors after excluding the center—an even number), not the window size itself. This standard practice ensures the median is always an actual pixel value from the neighborhood, enhancing statistical robustness.\n\n*   **Regarding W5 (MRF Justification):** You claim we do not explain the applicability of the MRF assumption. This is the very foundation of our method, explained in **Section 4.1**. On **Page 4, Lines 133-135**, we state: *\"According to the Markov Random Field (MRF) assumption, the probability distribution of a pixel depends only on its local neighborhood.\"* We then immediately provide the mathematical formulation (Equation 2) and build our entire LPD feature (Equation 5) upon this principle. The method itself *is* the justification for its applicability.\n\n*   **Regarding Q3 (Inclusion of VAEs):** Your question about VAEs highlights a key trend in generative AI. While we mention VAEs in our introduction to provide historical context, their primary role in the current state-of-the-art is not as standalone generators due to limitations in output fidelity. Instead, VAEs are now a critical component *within* Latent Diffusion Models (LDMs), where they function as powerful encoders and decoders for the latent space. Therefore, our mention of VAEs serves to trace the developmental lineage of generative techniques, acknowledging that the LDMs we extensively evaluate are fundamentally built upon them. Our evaluation correctly focuses on the final generative models (GANs, LDMs) as per established benchmarks.\n\n#### **2. Rebuttal of Methodological and Experimental Criticisms**\n\n*   **Regarding W8 & W9 (Performance vs. SOTA):** Your claim that our results are \"not competitive\" and improvements are \"marginal\" is a severe mischaracterization of the evidence presented.\n    *   **Efficiency vs. Accuracy Trade-off:** You state that FatFormer outperforms FerretNet in Table 1. You fail to mention the colossal difference in model size, which is a central point of our paper. As shown in **Table 4 (Page 8)**, FatFormer has **577.3M** parameters, while our FerretNet has only **1.1M** (**~0.2% of the size**) and runs **~8.7x faster**. Achieving competitive accuracy (95.9% vs. 98.4%) with a model that is 500 times smaller and vastly more efficient is a significant achievement, not a weakness.\n    *   **Superiority on Diffusion Models:** You call the improvement in Table 2 \"marginal.\" We respectfully disagree. Our FerretNet **outperforms the SOTA FatFormer** (96.9% vs 95.0% ACC). Defeating a model 500x its size on the most recent and relevant class of generative models is a clear and significant contribution, directly contradicting your assessment.\n\n*   **Regarding W10 (Utility of the Synthetic-Pop Dataset):** You argue that because our method exceeds 98% accuracy, the dataset is \"not challenging.\" This logic is flawed. The utility of a benchmark is to differentiate methods. As shown in **Table 3 (Page 7)**, on our Synthetic-Pop dataset, **our method achieves 98.3% ACC**, while existing SOTA methods like **FatFormer and NPR fail dramatically, scoring only 70.5% and 77.4% respectively**. This does not show the dataset is easy; it proves the exact opposite. It demonstrates that modern, high-quality generators pose a significant challenge to existing detectors, and it is precisely this challenge that our method successfully overcomes. The dataset is therefore highly valuable to the community.\n\n*   **Regarding W1, W2, W7 (Dataset Details, Related Work, and Missing Models):**\n    *   (W1) Key details of Synthetic-Pop are provided in **Lines 199-204**. We state the 6 models used, the source of captions and real images, and the total size. We commit to releasing the dataset with full documentation.\n    *   (W2) A deep review of foundational models is beyond the scope of a paper focused on a novel detection method. Our related work section correctly focuses on synthetic image detection literature, which is standard practice.\n    *   (W7) Thank you for pointing this out. FLUX is indeed a significant and very recent model. We did consider its inclusion during the construction of our Synthetic-Pop benchmark. Unfortunately, at the time of our experiments, we encountered significant technical challenges in deploying the model in a way that would ensure a stable and fair comparison, a common issue with novel, complex architectures upon their initial release. We therefore proceeded with a set of six other highly popular, diverse, and representative text-to-image models that form a strong and challenging basis for evaluation. We are actively working to integrate it and will certainly include it in future iterations of our work.\n\n*   **Regarding W3 & W4 (Clarity and Justification of Section 3):** Section 3 provides a high-level, unifying conceptual framework to motivate our search for common artifacts (latent space deviations and decoding inconsistencies). It is not intended as a rigorous mathematical proof of equivalence, but as an accessible intuition for why a universal detector might be possible. This framing is a valid and common rhetorical tool in scientific papers. Figure 1 serves as a standard visual aid for this two-stage process.\n\n---\n\nIn summary, we believe this review contains critical factual errors and misinterpretations that led to an unfounded negative conclusion. Our paper introduces a lightweight, efficient, and novel method grounded in statistical principles. It demonstrably outperforms the state-of-the-art on modern diffusion models and on a new challenging benchmark, all while being over 500 times smaller. We have provided comprehensive experiments and ablations that you yourself have acknowledged as a strength (S1). We kindly ask the Area Chair to consider these points and re-evaluate the validity of this review."}]

Author rebuttal:

Meta-review: This paper proposes FerretNet, a lightweight CNN for synthetic image detection that leverages Local Pixel Dependencies (LPD) in the residuals of median-filtered results motivated by Markov Random Fields. The main claim of the paper is that forgery detection should be considere as a statistical anomaly detection problem that should generalize across unseen generative models. FerretNet performs at high frame rates and uses1.1M parameters when compared to competing approaches in the literature like FatFormer.

Strengths:  The method is simple, it leverages a MRF assumption wherein the center pixel value in a given neighborhood is conditionally dependent and can be imputed via the median of the values in the neighborhood. The residual between the prediction and observed value is then fed as input to a lightweight detector lightweight deep net that uses depthwise separable and dilated convolutions. The experimental results demonstrate competitive accuracy to FatFormer while being lightweight and faster.  Moreover, the generic nature of the algorithm enables the model to be trained using one fake dataset (ProGAN data) while testing on many generative model paradigms (including various GANS, diffusion, autoregressive model.
Experimental methodology: Comprehensive ablations, robustness tests (e.g., resizing, rotation), and interpretability analyses are provided. Judging the detailed results on the tables 1, 2, and 3 the new algorithm seems to be competitive to FatFormer but mainly excels in the Synthetic-Pop dataset that the authors have constructed.  

Weaknesses:
a) Several reviewers noted that the Synthetic-Pop dataset is not clearly framed; while it differentiates current detectors, its long-term benchmarking value may be limited.
b) Interpretability of results: While the authors clarified LPD “signatures,” reviewers requested more intuitive visualizations at decision boundaries (false positives/negatives).
c) The architectural contribution (dual-path FerretNet) is careful engineering for LPD feature maps rather than a fundamentally new design (the authors acknowledge this and claim it is as a novelty).
d) No error bars are presented in the tables so that one can clearly understand the statistical significance of the claimed results. 

Reviewer feedback, rebuttal and consensus:
While a number of reviewers rate the paper high and there was a heated dialogue with request for clarification of details from the other reviewer, the reviewers agree overall that the paper is worth accepting.   As an area chair with extensive experience on statistical image analysis I find that there is lack of rigor in the theoretical justification for why this method works.  I would have liked to see more detailed discussion on the nature of conditional probability distributions (in local neighborhoods) and why median residuals would perform better than alternatives (e.g. why not residuals from other robust predictors such as a trimmed mean, mode, etc).
Decision: Accept (poster)