Breaking Latent Prior Bias in Detectors for Generalizable AIGC Image Detection
Authors: Yue Zhou
Xinan He
Kaiqing Lin
Bing Fan
Feng Ding
Bin Li
Venue: NeurIPS 2025 poster ()
Keywords: Multimedia Forensics
AIGC Image Detection
Primary area: applications

Abstract: Current AIGC detectors often achieve near-perfect accuracy on images produced by the same generator used for training but struggle to generalize to outputs from unseen generators. We trace this failure in part to latent prior bias: detectors learn shortcuts tied to patterns stemming from the initial noise vector rather than learning robust generative artifacts. To address this, we propose \textbf{On-Manifold Adversarial Training (OMAT)}: by optimizing the initial latent noise of diffusion models under fixed conditioning, we generate \emph{on-manifold} adversarial examples that remain on the generator’s output manifold—unlike pixel-space attacks, which introduce off-manifold perturbations that the generator itself cannot reproduce and that can obscure the true discriminative artifacts. To test against state-of-the-art generative models, we introduce GenImage++, a test-only benchmark of outputs from advanced generators (Flux.1, SD3) with extended prompts and diverse styles. We apply our adversarial-training paradigm to ResNet50 and CLIP baselines and evaluate across existing AIGC forensic benchmarks and recent challenge datasets. Extensive experiments show that adversarially trained detectors significantly improve cross-generator performance without any network redesign. Our findings on latent-prior bias offer valuable insights for future dataset construction and detector evaluation, guiding the development of more robust and generalizable AIGC forensic methodologies.

Breaking Latent Prior Bias in Detectors for Generalizable AIGC Image Detection
Yue Zhou', Xinan He², Kaiqing Lin', Bin Fan Feng Ding", Bin Li Guangdong Provincial Key Laboratory of Intelligent Information Processing,
Shenzhen Key Laboratory of Media Security,
and SZU-AFS Joint Innovation Center for AI Technology. Shenzhen University
Nanchang University
3 University of North Texas
Abstract
Current AIGC detectors often achieve near cear-perfect accuracy on images produced by the same generator used for training but struggle to generalize to outputs from unseen generators. We trace this failure in part to latent prior bias: detectors learn shorteuts tied to patterns stemming from the initial noise vector rather than learning robust generative artifacts. To address this, we propose On-Manifold Adversarial Training (OMAT): by optimizing the initial latent noise of diffusion models under fixed conditioning, we generate on-manifold adversarial examples that remain on the generator's 's output manifold-unlike pixel-space attacks, which introduce off- off-fonifold perturbations that the generator itself cannot reproduce and that can obscure the true discriminative artifacts. To test against state-of-ther of-the-art generative models, we introduce Genlmage++,, test-only benchmark of outputs from advanced generators (Flux.1. 1. SD3) with extended prompts and diverse styles. We apply our adversarial-trainig paradigm to ResNet50 and CLIP baselines and evaluate across existing AIGC forensic benchmarks and recent challenge datasets. Extensive experiments show that adversarially trained detectors significantly im- prove cross-generator performance without any network redesign. Our findings on latent-prior bias offer valuable insights for future dataset construction and detector evaluation, guiding the development more robust and generalizable AIGC forensic methodologies. Our dataset and code are publicly available at: https: btttp::/huuggingaacc ct/ httddaaastts/Lmmaeeeeee watear//eeimmmggpp.ge
Introduction
The rapid advancement of generative AI, from early GANs [ to modern diffusson models (36), has produced increasingly realistic synthesized images, creating critical need for robust Al-generated content (AIGC) forensic methodologies. While current AIGC detectors perform well on images from their training generator, they often exhibit significant generalization gap when faced with outputs from unseen generative architectures [48]. This suggests that detectors may learn 'shortcuts' features specific to the training generator rather than fundamental generative artifacts. Indeed, recent methods achieving better generalization often leverage Stable Diffusion [4] for data augmentation [ indicating valuable forensic signals within SD data that baseline detectors underutilize.
We hypothesize that a key reason for this shorteut learning the detector's sensitivity characteristics tied to the initial latent noise vector, 27. This is related to findings in Xu et al. 42], which showed that the specific aaahhhmaeallllellle for 27 can be identified from generated images, implying
Corresponding author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

learnable patterns in the noise sampling process. To investigate this, we conducted white-bon box attacks by optimizing only 2T (keeping text condition e and the SD generator fixed) against pre- trained CLIP+LLinen 33 and ResNet50 14] AIGC detectors. Our experiments revealed that standard, detectable generated images could consistently be transformed into undetectable ones via these 27 perturbations. Since the generation process remains otherwise unchanged, these resulting adversarial examples lie on the generator's s output manifold. We term these 'on-manifold adversarial examples', distinguishing them from often off-manifold pixel-space attacks. Their successful generation highlights the baseline detectors' reliance on non-robust features linked to zy's 's influence.
Building on this, we propose an on-manifold adversarial training paradigm. Incorporating these specialized adversarial examples into training significantly improves detector generalization. with our LoRA [88] fine-tuned CLIP-based model achieving state-of-the- performance on multiple benchmarks. Furthermore, to facilitate rigorous evaluation against contemporary generative models like Black Forest Flux.1
(0 and Stability Al's Stable Diffusion 3 [10], which feature advanced architectures (e-g.. DIT 30 and text encoders (e.g., T5-XXL (6), ) we introduce GenImage++, a
novel test-only benchmark. Our adversarially trained detectors maintain strong performance on this challenging new dataset.
Our contributions are threefold: (1) We are the first to systematically expose a vulnerability linked to the detector's s sensitivity to initial latent noise variations, identifying this as a significant factor contributing to poor generalization in AIGC detection.
(2) We are the first to apply on-manifold adversarial training-usinn only small set of additional latent-optimized examples- to achieve state- of-the-art generalization in AIGC detection. (3) We propose Genlmage++, benchmark incorporating outputs from cutting-edge generators to advance future AIGC forensic evaluation. Collectively, our findings on the detector's latent-space vulnerabilities and the efficacy of on-manifold adversarial training provide valuable insights for future dataset construction and the development of more robust and broadly applicable AIGC forensic methodologies.
2 Related Work
The detection of fully synthesized Al-generated content (AIGC) has evolved significantly. Early efforts targeting Generative Adversarial Networks (GANs) M often found success with conventional CNNs or by identifying salient frequency-domain artifacts [40). However, the rise of high-fidelity diffusion models [35 34 has presented more formidable challenge, primarily concerning the
generalization of detectors: models trained on one generator often fail dramatically on outputs from unseen architectures 48 (29]. This generalization gap indicates that detectors frequently learn superficial, generator-specife "shortcuts" rather than fundamental generative fingerprints.
Current state-of-the-art AIGC detectors increasingly leverage powerful pre-trained Vision-Language Models (VLMs) [46], as seen in methods such as UnivFD (29), C2P-CIIP (38), and ReDFD (21). Similarly, some methods
[3] 22 16 fttilizzze the common-sense knowledge of Multimodal Large
Language Models to prevent overfitting, although the generated explanations can be mislcading due lack of supervision. Another prominent strategy involves utilizing diffusion models themselves, either for reconstruction-bast
analysis (e.g., DIRE [4). 3) or extensive training data augmentation (e.g., DRCT 2 PPL 44), effectively expanding the training manifold. Our work diverges by hypothesizing and exposing a "latent prior bias," where detectors learn non- generalizable shortcuts tied to the initial latent noise 2T. We address this by proposing on-manifold adversarial training with relatively small, targeted set of 27-optimized examples. This approach efficiently compels the learning of more robust features, achieving state-of-the-ar generalization without relying on massive data augmentation or complex reconstruction pipelines.
3
Unveil Latent Prior Bias within AIGC detectors
3.1 Standard AIGC Detection and the Generalization Challenge
The fundamental task AI- Al-generated content (AIGC) forensies is to distinguish between real images, drawn from distribution PR. and Al-generated images. A standard approach involves training neural network detector, Dz X -> parameterized by di using samples from Pn (labeled as real, y 0) and samples generated by specific source generative model G. drawn from distribution Pe

---

(labeled as fake, 1). The detector is typically trained by minimizing an expected loss, such as the Binary Cross- Eessooyy (BCE):
(I) where ((8,y) y) is the BCE loss function. Minimizing Litad enables the detector D& learn set of discriminable features effective for separating the specific distributions Pn and Pg encountered during training.
Lata(0) P (Z 0)] Exo ((( ((Cce)))),)))) 1)]:
However, a critical objective in AIGC forensics is generalization: the ability of the detector Dø.
trained primarily on data from generator G, to effectively detect images produced by novel, previously
unseen generators (with distributions Pc') ). Ideally, the features learned by minimizing Eq. (T should capture fundamental properties indicative of the Al generation process itself, allowing for robust performance across diverse generative models. Yet, empirical evidence often reveals a significant performance degradation when detectors evaluated on unseen generators, indicating that the learned features may be overly specific to the artifacts of the training generator G, a phenomenon often attributed to sample bias and shorteut learning. Addressing this generalization gap a central challenge we tackle in this work.
3.2 Disentangling Process-Inheroes Artifacts from Input Conditioning
To develop detectors capable of robust generalization, we must first understand how inputs influence the output of typical generative models and then aim to disentangle true forensic features from input-specific characteristies. We examine the structure of modern conditional text-to-image gener- ators, specifically models like Stable Diffusion which often employ Denoising Diffusion Implicit Models (DDIM) (55) for image synthesis. The DDIM process generates target data sample (latent representation 20) starting from Gaussian noise 2T ~ / (0, I) via an iterative reverse process over timesteps & = T...., , 1. Given the latent state at timestep and conditioning information (e.g.. text embeddings), neural network e0(z,, L, c) predicts the noise component "pred added at the corre- sponding forward diffusion step. The DDIM sampler then deterministically estimates the previous latent state 1 using ž₁ and 'pred"
(t)
(t) pred E0(2), (c),
(1) v Erep
2t
2t /
/1 αz- 14 (fred
Vāz
where â, represents the noise schedule coefficients. After T steps, the final latent zu is decoded to the image 2g Dec(20) using VAE decoder Dec.
Crucially, this generation process, Zp SD(2T, c). involves two primary inputs: the conditioning c and the initial random noise zT- The conditioning e primarily dictates the high-level semantic content and style of the generated image Tg- In contrast, the core iterative denoising mechanism (Eq. (3)), the architecture of ea, and the final decoder Dec constitute the fixed machinery of the generator that operates on these inputs.
We posit that the most generalizable forensic features those indicative of an image being Al-generated regardless its specific content or source model-are likely tied to artifacts arising from these intrinsic, input- inpuutindeeendent components of the generation pipeline (e.g.. the denoising dynamics, network architectures of 6ø or Dec, upsampling methods). Since generalizable detection requires recognizing AI generation across diverse content (thus demanding features largely independent of condition c), a critical question arises: could detectors, in their attempt to distinguish fakes, inadvertently learn shortcuts from the other primary input, the initial noise 27? If the specific instance or sampling process of 2r imparts any learnable, yet non-generalizable patterns, this could hinder the acquisition of true fyen- The finding by Xu al. (42) that 2T seeds are classifiable from generated images lends plausibility to this concern. Our subsequent methodology is therefore designed to investigate this potential source of shortcut learning.
3.3 Exposing Latent Prior Bias via On-Manifold Attack
As established (Section 3.1. standard AIGC detectors often exhibit poor generalization. Building on the concern that detectors might learn shortcuts from the initial noise 2r (Section 3.2). we hypothesize
3

---

Forward
Backward
photo of
[imageNet_Labee
Stable Diffusion 1.4
Detector
Figure I: Illustration of our white-box attack methodology. The initial latent noise 27 is iteratively optimized based on gradient feedback from the frozen detector De. while the prompt e and Stable Diffusion generator remain fixed.
that significant factor contributing to this generalization failure is phenomenon term latent prior bias. This bias describes the scenario where detectors, trained on images generated from 27 vectors sampled from a prior (e.g., (0, T)), overfit to image characteristics directly influenced by these 27 instances. Instead of acquiring truly robust generative fingerprints (fgen), these detectors learn "shortcuts" by exploiting subile but learnable patterns tied the 27-influenced variations. Consequently, the learned decision boundary becomes biased, performing well on the seen generator (Pa) but poorly on unseen ones (Per).
To directly test this hypothesis and empirically expose the latent prior bias, we designed a white- box On-Manifold attack by perturbing the initial latent noise 27- Illustrated in Figure [ the core objective is to find an optimized latent 23dv near an initial random 2T such that the image uadd = (D c), generated with a fixed prompt c and frozen generator SD (Stable Diffusion vl.4), fools a target detector Dz. This is formulated
optimization problem where seek to minimize the detector's 's confidence that the generated image is fake (i.e., make appear real, target
label y 0). Given 27
(k) (0) zaand the optimizable latent 27 at iteration k is updated to minimize the following adversarial loss Ladv:
Ladv (+(-)) (SD(2z) c)).
(4)
where E(.,)) is the BCEWithLogits loss. The update rule using Stochastic Gradient Descent (SGD) is:
(k+1) (k) V (2) Ladv (2)
(5)
where 77 is the learning rate. This iterative optimization (detailed in Algorithm D Appendix A.
continues for a maximum of K 100 steps or until the success condition (D (P(S((Z) (1) .c))) <
0.5 is met. We applied this attack to GenImage SDv1.4 pre-trained CLIP ViT-L/14 Linear and ResNet50 detectors in [] For each of the 1000 unique class labels sourced from the ImageNet- 1k dataset we constructed the text prompt using the template "photo of [label]". To ensure a substantial and diverse set of adversarial examples for further training, and aiming for a scale comparable standard test sets, we systematically generated six successful adversarial examples for each of the 1000 prompts, using different initial random seeds s for each success. This process yielded our adversarial dataset Xady. comprising N 6000 unique on-manifold adversarial images.
Figure 2: Distribution of optimization steps for successful on-manifold latent attacks targeting CLIP+Linear (left) and ResNet50 (right) detectors. Max optimization steps 100.

---

3,4 Attack Performance and Evidence of Latent Prior Bias
Baseline Detectability Confirmed. Executing the on- on-manifold latent attack described in Section 3.3
first confirmed the competence of our baseline detectors. As illustrated by the insets in Figure 2 images generated from the unoptimized initial latent noise 2/and (i.e., step 0 of our attack optimization) were consistently classified as fake by the respective detectors across all 1000 prompts. This establishes that the detectors are effective against typical outputs generated using the standard 2r sampling strategy from the training generator.
Universal Vulnerability Exposes Latent Prior Bias. Despite this initial detectability, our subsequent latent optimization revealed a profound vulnerability. For every one of the 1000 prompts, we successfully found multiple initial seeds for which 27 zzaad could be optimized into 27 that
(KK)) < 0.5). These 27 =dev-derived images remained on-manifold, with qualitative inspection (see Appendix Figure 5 confirming their visual coherence and semantic alignment. The consistent success in rendering initially detectable outputs undetectable, achieved solely by perturbing 27, provides strong empirical evidence for the latent prior bias. It demonstrates that the detectors' decisions critically influenced by learnable, yet non-robust, characteristics tied to the initial latent noise, rather than relying purely on fundamental generative artifacts.
fooled the target detector (i.e., (
Attack Effficiency Points to Pervasive Latent Prior Bias. The dynamics of these successful attacks further characterize this vulnerability. As shown in the main histograms of Figure [ a significant number of attacks succeeded rapidly (often within s100 optimization steps). This implies that for many z the decision boundary influenced by latent prior bias is very close and easily crossed with minimal Zy perturbation, underscoring the pervasiveness of this bias.
4 Mitigating Latent Prior Bias via On-Manifold Adversarial Training
Having established that standard AIGC detectors exhibit a latent prior bias by relying on non-robust, 2r-influenced shortcut features (Section 3.3) we now introduce our remediation strategy: On- Manifold Adversarial Training (OMAT). OMAT leverages the on-manifold adversarial examples Xunv-ggner by optimizing 27 to expose these very shortcuts-to retrain the detector.
The core mechanism of OMAT is to alter the detector's learning objective. By augmenting the training data with Xadv (labeled as fake, y = 1) and penalizing their misclassification, we render the previously learned zi-influeeeed shortcuts ineffective for minimizing the training loss. This forces the detector to identify alternative, more robust features. Crucially, since our Xady are on-manifold (i.e., valid outputs of the generator SD that differ from standard outputs primarily in their ze-ierieed characteristics, not via off-manifold pixel noise), they retain the intrinsic generative artifacts (fea) common to the generator's process. OMAT thus compels the detector to become sensitive to these fgen as the consistent signals for distinguishing both standard fakes (Pc) and our on-manifold adversarial fakes (Xadv) from real images (PR).
This retraining process discourages overfitting to superficial in-infledceed characteristics and instead promotes the learning of features more deeply ingrained in the generation process itself. Such features are inherently less dependent on the specific initial 2T and thus more likely to be shared across diverse generative models. This shift-from relying on 2n-influenced shortcuts to recognizing fundamental fgen-is the key mechanism through which OMAT mitigates latent prior bias and, as demonstrated by our experiments (Section (6). leads to substantial improvements in generalization. This approach aligns with the understanding that robustness to on-manifold adversarial examples is intrinsically linked to generalization 37 Specific implementation details are in Appendix A.2
GenImage++: Evaluating Detectors in the Era of Advanced Generators
While the GenImage dataset 48 provides valuable baseline, the rapid evolution of generative mod- els necessitates benchmarks that reflect current tfate-of-the-ar capabilities. Recent models, notably FLUX.1 (20 and Stable Diffusion 3 (SD3) [10), signify a leap forward, often employing distinct architectures like Diffusion Transformers (DiT) 30 and significantly more powerful text encoders (e.g., T5-XXL 6).. To provide a more rigorous testbed for generalization against these contemporary capabilities, we introduce GenImage++, a novel test-only benchmark dataset. GenImage++ is designed around two core dimensions of advancement, reflecting the "++" in its name:
5

---

Advanced Generative Models: It incorporates images generated by state-of-the-aee art models, primarily FLUX.1 and SD3, directly test detector performance against the latest architectures and their distinct visual signatures.
Enhanced Prompting Strategies: It moves beyond simple prompts by including subsets specifically designed to leverage the improved text comprehension of modern generators. This includes images generated from complex, long-form descriptive prompts and wide array of diverse stylistic prompts.
Figure provides illustrative examples from Genlmage++. The benchmark comprises multiple subsets, each targeting specific advancements. These include testing baseline performance standard prompts with Flux and SD3, assessing cong-pronp comprehension, evaluating robustness to style diversity (using Flux, SD3, and comparative models like SDXL and SD1.5), and challenging detectors with high-fidelity portrait generation. Full details on its construction, including specific generators, prompt engineering, and subset composition, are provided in Appendix
Base Label
Long- Prompt
Style
Photo
F34 6
Figure 3: Example images from our proposed Genlmage++ benchmark. Columns from left to right: (I) Base Label (e.g., "backpack") generated using standard prompts by advanced models; (2) Long- Prompt comprehension. where base labels are expanded into complex scenes (c.g.. "backpack" in mountain setting); (3) Style diversity, illustrating varied artistic renditions; and (4) Photo realism, focusing on high-fidelity human portraits and photorealistic scenes.
Experiments
6.1 Experimental Setup
Training Paradigm and Our Models. Our experiments primarily follow the GenImage 48
benchmark paradigm. Unless otherwise specified, all detectors, including our initial baselines and external methods, were trained on the Stable Diffusion v1.4 (SDv1 .4) subset of GenImage using real
images and corresponding SDv1.4 generated fakes. Our initial detectors are based ResNet50 (15) and CLIP ViT-L/14 + Linear Head (33]. For adversarial training. these baseline detectors were subsequently fine-tuned using the L.v training data augmented with N 6000 of our on-manifold
adversarial examples (Xadv) generated as described in Section 3.3 For CLIP+Lincar, adversarial fine-tuning was explored via three strategies: Linear Only, Full Fine-tuning, and LoRA+Linear [8
These baseline and adversarially trained variants constitute our proposed models.
Evaluation Datasets and Metrics. To assess generalization capabilities, we test the trained detectors across a various datasets, including: the original GenImage benchmark; our proposed Genlmage++ benchmark (described in Section and Appendix C). which introduces images from advanced generators like Flux and SD3 under challenging conditions; and the Chameleon dataset 43 which comprises diverse Al-generated images collected "in the wild". We assess detector performance using Accuracy (ACC).
External Baselines for Comparison. The performance of our models is benchmarked against several external methods. This includes a suite of established standard forensic detectors (e.g.. CNNSpot [40), GramNet (25), UniFD [29]. SRM (26), AIDE (3) which analyze image artifacts directly. We also compare against recent state-of- sfate-of-thhaart the-art generator-leveraeeee leveraging approaches: DIRE [41), which uses SDv1.4 .4 for reconstruction, and DRCT 2 which employs SDv1.4 for training data augmentation.
Implementation Details. Specific hyperparameters for training. LoRA configuration, image prepro- cessing, dataset compositions, and other relevant implementation choices provided in Appendix A

---

Table 1: Generalization performance (Accuracy %) various Genlmage subsets. Models were trained on the SDv1.4 1.4 subset. For each column, the best result is marked in bold and the second best underlined. For our adversarially trained models, the change relative to their respective baseline is shown in parentheses (a for improvement, for degradation).
Model
Midloumny
SDv1.
Wakong
VQDM
BigGAN
Stondarel Forenste Methods
Xeeption [5]
57.97
98,06
97.98
51.16
57.51
97.79
50.34
48.
69.94
CNNSpal
61.25
98.
97.54
51.50
55.13
93.51
$1.83
51.06
69.99
22
52.26
GramNet 351
63.00
91.19
91.22
48.69
16.19
93.79
19.20
11.71
66.75
UniFD 19
77.29
97.01
96.67
50.94
78.47
91.52
65.72
55.91
77.29
NPR 19
62.00)
19:75
99.64
56.79
82.69
89
54.43
$2.26
75.68
21
SRM 26
54,10
99.80
99.80
29,90
52.80
99.60
50.00
$1,00
AIDE 43
79.38
199
99.76
78.54
91.82
98.65
N0.26
66.89
86.88
Generalor- Leverngnngggggggngggggg Methody
DIRE
51.11
55.07
55.31
50.02
53.71
86
99.37
99.19
73.31
59:41
DRCTUUIFD
2
85.82
92.33
91.87
75.18
87.44
92.25
89.12
87.
87.67
Our Modefr (Baveline)
ResNet50
61.88
99.
98.97
$0.00
52,82
97.53
70.18
CinPs
78.89
57.53
79.20
Our Modely (OMA)))(OMAT)
ResNet50
80.49
84
83
58.13
83.22
65.58
62.76
74,13
CLIP Pull Fine-tune
82.18
89.68
45.45
87.65
81.94
82.28
84-99
84.5%
Only
86.79
14:00
CLIP+LoRA (Rank 4)
90.36
v4:50
97.52 m1:i:
97.46 wian
83.82 (o00a0
97.41 (40.52
97.62
95.53
97.34
94.63
CLIP+LoRA (Rank 8)
$9.62
+3.50
95.13
1370
94,85
79.11 (422
94.68
94.97
90.44
91.37
91.27
H1200
CLIPsLoRA (Rank
88.57
94.82
94.32
80.98
22
94.69
93.82
93.22
91.84
Table 2: Comparison the Chameleon, Accuracy (%) of different detectors (rows) in detecting real and fake images of Chameleon For each training dataset, the first row indicates the Acc evaluated on the Chameleon testset, and the second row gives the Ace for "fake image real image" for detailed analysis.
Training Set CNNSpot
GramNet
LNP
UnivED
DIRE
PatchCraft
NPR
AIDE
Our
SD v1.4
60.11
55.62
56.32
66.05
8.86/98.63
17.65/93.50
0.57/97.01
74.97/41.09
11.86/95.67
3.07/96.35
2.43/100.00
20.33/94.38
33.93/90.17
6.2
Generalization Performance on GenImage
We evaluate the generalization capabilities of our proposed adversarial training strategies and com- pare them against established baselines various subsets of the GenImage dataset. Performance, measured by accuracy (%), is reported in T
Our On-Manifold Adversarial Training strategy consistently enhanced the generalization capabilities of all baseline detectors. Notably, the OMAT CLIP+LORA (Rank 4) achieves a state-of-the-as average accuracy of 94.63% % across all Genlmage subsets. This marks + +15.43% improvement over its vor-ailersarially trained baseline (79.20%) and surpasses all other evaluated methods. This superior performance is driven by large gains challenging OOD subsets (e.g.. +30.00% on ADM, +39.81% % on BigGAN) while largely maintaining or improving strong performance on in-domain data. These results strongly validate our central hypothesis: mn-aniioldd adversarial training effectively mitigates the identified latent prior bias by compelling the detector to learn from challenging latent perturbations- developing more robust, generalizable features that yield consistent high performance across diverse seen and unseen generators.
than relying shorteut features tied to initial noise -hhnney
6.3 Performance on the Challenging Chameleon Benchmark
To rigorously evaluate generalization against diverse "in-the-wild" content, we tested our best OMAT model (CLIP+LoRA Rank 4) on the challenging Chameleon dataset [43]. Our model was trained using only the SDv 1.4 subset of Genlmage, augmented with our on- on-manifold adversarial examples. Table compares our results against baselines from [43] under the same SDv 1.4 training condition. Against this backdrop of established difficulty, our adversarially trained model achieves an average accuracy of 66.05% on Chameleon. This surpasses not only all baselines trained under the comparable SDv1.4 protocol (Table 2 but also notably exceeds the best reported performance (65.77% by AIDE)
7

---

Table 3: Performance (Accuracy %) of detectors proposed Genlmage++ benchmark subsets. All detectors were trained on the SDv1.4 subset Genlmage. Column headers are abbreviated for space: Flux Multi (Flux multistyle), Flux Photo (Flux photo), Flux Real (Flux realisss,,,,,) SD1.5
Multi (SD1.5_ml) (SDils_multistylle, SDXL Multi mulissyll SD3 Photo (SD3_photo), SD3 Real
(SD3_realistic))
Model
Flux
Flux Multi
Hux Photo
Flx Real
SDL.5 Multi
SDXL Multi
S03
S135 Photo
S13 Real
Avg
Xception
36.86
10.48
4.65
5.45
97.27
20.63
38,00
5.8.1
15.06
26.03
CNNSpol
34.79
47.70
F3Ne: 32
25. 18
7.79
2.83
7,90
94.15
24.01
46.67
0.84
30.28
26.63
GramNell 25
37.83
16.71
8.01
19.71
96.49
28.65
48.55
8.33
55.71
15.55
NPR 39
35.38
13.19
8.48
19.41
93.63
15.40
32.
12.45
27.58
28.66
SPSI
67.13
43.76
25.73
71.14
17.74
44.58
29.75
36.96
SRM 26
8.46
2.92
0.37
1.93
96.62
6.39
9:97
0.55
4.43
14.63
DRCT/UmFD (SD> 1
71.08
63.97
46.83
62.42
99.19
64.84
72.28
70.70
73.55
69.43
DRCTCCo--B (
66.40
C2P-CLIP33
0.66
0.21
0.00
0.14
11.78
18.66
1.51
0.20
0.13
7.03
CO-SPY [1]
94.25
96.99
99.32
98.23
85.31
$8.27
75.38
92.70
92.33
87.98
19NE
93.33
67.87
77.57
84,56
97.13
94.57
97.91
90.99
91.65
88.40
ParchShuffee
97.30
97.82
70.67
81.61
Our (CLIP R4)
96.53
92.55
97 80
97.67
100.00
99.17
98.27
90.38
98.82
96.78
for models trained on the entire GenImage dataset imparted by our approach.
43
highlighting the significant generalization
6.4 Performance on the Genlmage++ Benchmark
We further evaluated all detectors trained on the SDv1.4 subset of Genlmage against our newly proposed Genlmage++ benchmark (described in Section 5). The performance (Accuracy %) on various Genlmage++ subsets detailed in Table
GenImage++ Exposes Generalization Limits and Architectural Specificity. The results clearly demonstrate the challenging nature of Genlmage++ for detectors trained solely on older SDv1.4 data (Table Most standard forensic methods and even the strong DRCT (SDv1) baseline (69.43% average) struggle significantly on subsets generated by advanced models like Flux and SD3, par- ticularly on their multi-style, photorealistic, and complex prompt variations, with many baseline accuracies falling below 40% or even 20%. This starkly indicates that features learned from SDv1.4 are insufficient for these modern generative capabilities.
Our OMAT Achieves Robust Generalization on Advanced Models. In stark contrast, our adver- sarially trained CLIP+LORA (Rank 4) model demonstrates vastly superior and remarkably consistent generalization across all subsets of Genlmage++, achieving average accuracy of 96.78%. %. It achieves over 90% accuracy on nearly every subset, including those that prove extremely difficult for the baselines. This exceptional performance, indicates that our on-manifold adversarial training successfully forced the learning of more fundamental generative artifacts (Sgen) that are robust not only across styles within similar architectures but also across entirely different advanced models and their diverse generation modes.
6.5 Achieving Generalization through On-Manifold Robustness
To investigate the relationship between generalization and on-manifold attack robustness, we re-attack three CL.IP+Linear detector variants, selected based on their varied generalization performance demonstrated in Table (i) the Baseline model (poorest generalization), (ii) the Adv Train Linear model (moderate generalization), and (iii) the Adv Train LoRA (Rank 4) model (best generalization).
Table 4: Robustness of CLIP+Linear detectors against the latent optimization attack after different adversarial training strategies. Attacks were performed on 100 ImageNet labels.
Metric
Baseline
OMAT Linear
OMAT LoRA
(No Adv Train)
(Linear Only FT)
(LoRA Rank 4 FT)
Success (%)
25
Avg Step
43.56
62.86
161.42
8

---

The results, presented in Table reveal a strong correlation between generalization capability and on- manifold robustness. The Baseline model was most vulnerable. The Adv Train Linear model showed improved robustness, corresponding to its better generalization. Critically, the Adv Train LoRA model, which achieved state-of-the-art generalization, exhibited the highest on-manifold robustness by significant margin. This clear where models demonstrating superior generalization are also substantially more resilient to on-manifold attacks targeting latent prior bias biov-provides strong evidence for our hypothesis. It suggests that mitigating this bias through effective on-manifold adversarial training is a key mechanism for developing truly generalizable AIGC detectors.
6.6 Comparison with Pixel-Space Adversarial Training
To further contextualize the benefits of our on nn-manifold latent optimization, we compared its efficacy against adversarial training using examples generated by common T-c- -bounded pixel-space attacks: FGSM [2], PGD (27). and MI-FGSM [8] each with varying perturbation budgets (c). These pixel-space adversarial examples targeted the same baseline CLIP+Linear detector our latent attacks. The CLIP+LoRA (Rank 4) model was then adversarially trained with these different sets of pixel-space examples. presents the average accuracy on the GenImage test subsets.
While adversarial training with all evaluated pixel-space attacks consistently improved generalization over the baseline, these gains substantially smaller than those from our mn-manifold approach. This marked performance difference suggests that our on on-manifold adversarial examples, generated by perturbing the initial latent space 2T and processed through the full generative pipeline, more effective at compelling the detector to learn truly generalizable features sgen- Pixel-space attacks, though offering some improvement, seem less adept correcting the biases that hinder generalization compared to our on-manifold latent perturbations. This underscores the critical role of the type of adversarial examples in achieving robust generalization for AIGC detection.
Table Impact of adversarial training using different types of adversarial examples on CLIP+LORA (Rank 4) generalization. All adversarial examples were generated targeting the baseline CLnP+Linear detector trained on SDv1.4.
Adversarial Training Data Source (Attack Type)
Avg. GenImage Ace (%)
Baseline Adversarial Training)
79.19
RGB-Leve! Pixel- Pixel-Space Attacks (Loc -bounded)
FGSM 0.03)
82.11
FGSM 0.05)
83.18
FGSM (c- -0.1)
83.49
PGD 0..03, 0.005, 20)
82.28
PGD (r 0.05, 0'
82.63
PGD (r = 0.1,a=00.02, T
83.11
MI-FGSM 0.03, 0..055, 20)
81.76
MI-FGSM (c 0.05, = =0.01, 7 = =0))
82.61
MI-FGSM (< = 0.1, 0.015, = =30)
83.16
On-Manifold Attack
94.63
6.7 Sensitivity to the Adversarial Sample Budget
To understand the impact of the number of adversarial examples on our method's performance, we conduct an ablation study analyzing the sensitivity of OMAT to the size of the adversarial training set. For this experiment, fine-tune adversarial examples we generated, ranging from 0% (the bascline without OMAT) to 100%. We then evaluate the average accuracy on the GenImage benchmark for each configuration.
detector using different proportions of the 6,000 on-manifold
Table Ablation on the proportion of the 6,000 adversarial examples used for OMAT fine-tuning. We report the average accuracy (%) on the Genlmage benchmark.
Adv. Examples Used
0%
10%
%
50%
100%
Avg. GenImage Aec. (%)
79.19
90.06
91.10
93.03
94.08
94.63
The results, presented in Table 6 show that OMAT's performance scales gracefully with the adver- sarial sample budget. Notably, using just 10% of the generated examples (600 images) boosts the

---

average accuracy from 19% to 90.06%, significant improvement of over 10 percentage points. The performance gains continue increase with more samples, albeit with diminishing returns. demonstrating that our method is both data-efficient and robust to the exact size of the adversarial set. This confirms that even modest budget of on-manifold examples highly effective at mitigating the latent prior bias we identified.
7 Conclusion
In this work, we identified latent prior bias phenomenon where AIGC detectors learn non- generalizable shortcuts tied to the initial latent noise 2T- as a key factor limiting their gensrate performance. We demonstrated this bias empirically using novel on- on-manifold attack that optimizes 2T to consistently fool baseline detectors. mitigate this, we proposed On-Manifold Adversarial Training (OMAT), which leverages these zr-optimized adversarial examples. Our experiments show that OMAT significantly enhances generalization, with our CLIP+LORA model achieving state- of-the-art art performance established benchmarks and our newly introduced Genlmage++ dataset, which features outputs from advanced generators like FLUX.1 and SD3, Our findings underscore that addressing latent-space vulnerabilities is crucial for developing AIGC detectors that robust not just to seen generators but also to novel architectures and varied generation conditions. Our work illuminates the path: by systematically identifying and mitigating deep vulnerabilities such as latent prior bias in training data, we can drive the development forensic tools capable of discerning fundamental, broadly applicable generative fingerprints.
Acknowledgments and Disclosure of Funding
This work supported in part by the National Natural Science Foundation of China (Grants U23B2022, U22B2047, 62262041), the Shenzhen R&D Program (Grants JCYJ20250604181211 1016, XYSPG202412211140320494 and the Jiangxi Provincial Natural Science Foundation (Grant 20232HAB202011)
References
[1] George Cazenavette, Avneesh Sud, Thomas Leung, and Ben Usman. Fakeinversion: Learning detect images from unseen text-to-image models by inverting stable diffusion. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10759-10769. 2024.
[2] Baoying Chen, Jishen Zeng. Jianquan Yang, and Rui Yang. DRCT: Diffusion reconstruction contrastive training towards universal detection of diffusion generated images. In Forty-first International Conference Machine I Learning, 2024.
[3] Ruoxin Chen, Junwei Xi. Zhiyuan Yan, Yue Zhang, Shuang Wu, Jingyi Xie, Xu Chen, Lei Xu, Isabel Guan, Taiping Yao, et al. Dual data alignment makes ai si-generated image detector easier generalizable. arXiv preprint arXiv:2505. 14359, 2025.
[4] Siyuan Cheng, Lingjuan Lyu, Zhenting Wang. Xiangyu Zhang, and Vikash Sehwag. Co-spy: Combining semantic and pixel features to detect synthetic images by ai. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 13455-J7 13465, 2025.
[5] Francois Chollet. Xception: Deep learning with depthwise separable convolutions. In 2017 IEEE
Conference on Computer Vision and Pattern Recognition (CVPR), Jul 2017.
[6] Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Yunxuan Li, Xuezhi Wang, Mostafa Dehghami, Siddhartha Brahma, et al. Scaling instruction-finetuned language models. Journal of Machine Learning Research, 25(70):1-53, 2024.
[7] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hicrarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255, 255. lcce, 2009.
[8] Yinpeng Dong. Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 9185-9193, 2018.
10

---

[9] D. Ponsa E. Rublee E. Riba, D. Mishkin and G. Bradski. Kornia: open source differentiable computer vision library for pytorch. In Winter Conference on Applications Computer Vision, 2020.
[10] Patrick Esser, Sumith Kulal, Andreas Blattmann. Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, al. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first international conference on machine learning, 2024.
[11] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM, 63(11):139- 144, 2020.
[12] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy, Explaining and hamesssin adversarial examples. arXiv preprint /412.6577 2014.
[13] Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al- Dahle, Aiesha I Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783; 2024.
[14] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[15] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Jun 2016.
[16] Xinan He, Yue Zhou, Bing Fan, Bin Li, Guopu Zhu, and Feng Ding- Viforgery face triad: Detection, localization and attribution via multimodal large language models. arXiv preprint arXiv:2508.06142 2025.
[17] Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: reference-Iree evaluation metric for image captioning. arXiv preprint arXiv:2104.087/8 18, 2021.
[18] Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang. Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. ICLR, 1())3, 2022.
[19] Christos Koutlis and Symeon Papadopoulos. Leveraging representations from intermediate encoder-blocks for synthetic image detection. In European Conference on Computer Vision, pages 394 411. Springer, 2024.
[20] Black Forest Labs. Flux.
2024.
[21] Kaiqing Lin, Yuzhen Lin, Weixiang Li, Taiping Yao, and Bin Li. Standing on the shoulders of giants: Reprogramming visual-language model for general deepfake detection. In Proceedings of the AAAI Conference on Artificial Intelligence. volume 39, pages 5262-5270, 2025.
[22] Kaiqing Lin, Zhiyuan Yan. Ruoxin Chen, Junyan Ye, Ke- Yue Zhang. Yue Zhou, Peng Jin, Bin Li, Taiping Yao, and Shouhong Ding. Seeing before reasoning: A unified framework for generalizable and explainable fake image detection. arXiv preprint 2rXiv:2509.25500 2025.
[23] Kaiqing Lin, Zhiyuan Yan, Kc- Yue Zhang, Li Hao, Yue Zhou, Yuzhen Lin, Weixiang Li, Taiping Yao, Shouhong Ding, and Bin Li. Guard me if you know me: Protecting specific face-identity from deepfakes. arXiv preprint 2555v 19582, 2025.
[24] Honggu Liu, Xiaodan Li, Wenbo Zhou, Yuefeng Chen, Yuan He, Hui Xue, Weiming Zhang, and Nenghai Yu. Spatial-phase shallow learning: rethinking face forgery detection in frequency domain. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pages 772-781, 2021.
[25] Zhengzhe Liu, Xiaojuan Qi, and Philip HS Torr. Global texture enhancement for fake face detection in the wild. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8060-8069, 8069, 2020.
[26] Yuchen Luo, Yong Zhang, Junchi Yan, and Wei Liu. Generalizing face forgery detection with high- frequency features. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 16317 16326, 2021.
[27] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.00 06083, 2017.
[28] Chenlin Meng. Yutong He, Yang Song, Jiaming Song. Jiajun Wu, Jun-Ya Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations. arXiv preprint 27X00:2008.0073. 2021.
11

---

[29] Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detectors that generalize across generative models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24480-24489, 2023.
[30] William Peehles and Saining Xie. Scalable diffusion models with transformers. In Proceedings of the IEFE/CVF international conference on computer vision, pages 4195-4205, 2023.
[31] Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach, Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952. 2023.
[32] Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by mining frequency-awar clues. European conference on computer vision, pages 86-103. Springer, 2020.
[33] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 8748-8763, PmLR, 2021.
[34] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björ Ommer. High-resohution image synthesis with latent diffusion models. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pages 10684-10695, 2022.
[35] Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502. 2020.
[36] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. bosre-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456 2020.
[37] David Stutz, Matthias Hein, and Bernt Schiele. Disentangling adversarial robustness and generalization. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6976-6987, 2019.
[38] Chuangchuang Tan, Renshuai Tao, Huan Liu, Guanghua Gu, Baoyuan Wu, Yao Zhao, and Yunchao Wei. C2p-clip: Injecting category common prompt in clip to enhance generalization in deepfake detection. In Proceedings of the AAAI Conference Artificial Intelligence, volume 39, pages 7184-7192, 2025.
[39] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethinking the up- sampling operations in enn-based generative network for generalizable deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 18130-28139) 2024.
[40] Sheng- Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn-generated images are surprisingly casy to spot... for now, Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8695-877 8704, 2020.
[41] Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and Houqiang Li. Dire for diffusion gennrrtte image detection. Proceedings of the IEEE/CVE International Conference on Computer Vision, pages 22445,22455,.2 2023.
[42] Katherine Xu, Lingzhi Zhang, and Jianbo Shi. Good seed makes good crop: Discovering secret seeds in text-to-image diffusion models. In 2025 IEFF/CVP Winter Conference on Applications of Computer Vision (WACV), pages 3024-3034. IEFF, 2025.
[43] Shilin Yan, Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Weidi Xie, sanity check for ai-generated image detection. arXiv preprint arXiv:2406. 222244464444 19435, 2024.
[44] Zheng Yang, Ruoxin Chen, Zhiyuan Yan. Yue Zhang, Xinghe Fu, Shuang Wu, Xiujun Shu, Taiping Yao, Shouhong Ding, and Xi Li. All patches matter, more patches better: Enhance ai-generated image detection via panoptic patch learning, arXiv preprint ar Xxvv:2254.00.333
2025.
[45] Chende Zheng, Chenhao I. Lin, Zhengyu Zhao, Hang Wang, Xu Guo, Shuai Liu, and Chao Shen. Breaking semantic artifacts for generalized ai-generated image detection, Advances in Neural Information Processing Systems, 7..59570-59596 2024.
[46] Yue Zhou, Xinan He, Kaiqing Lin, Bing Fan, Feng Ding, Jinhua Zeng and Bin Li. Brought a gun to a knife fight: Modern vim baselines outgun specialized detectors on in in-the-wild ai image detection. arXiv preprint arXiv:2509.1294 2025.
12

---

[47] Zikai Zhou, Shitong Shao, Lichen Bai, Zhiqiang Xu, Bo Han, and Zeke Xie. Golden noise for diffusion models: A learning framework. arXiv preprint arXiv:4411.09502. 2024.
[48] Mingjian Zhu, Hamting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei I., Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang. Genimage: million-scale benchmark for detecting ai ai-generated image. Advances in Neural Information Processing Systems, 36:77771-77782. 2023.
13

---

A Implementation Details
A.1 Latent Optimization Attack Generation
This section provides detailed hyperparameters and implementation choices for the on-manifold adversarial attack generation process described conceptually in Section 3.3 and Algorithm [
and
The goal was to iteratively optimize an initial latent noise vector z into an adversarial vector 27. such that the generated image =0 SD (D(g c) fooled a target detector Da (a (P(agd))) 0.5), while keeping the generator SD and prompt e fixed.
Objective Recap.
Algorithm Single Attempt: On-Manifold Latent Noise Optimization Attack
Require: Frozen detector Dg. Frozen generator SD, Text prompt c, Seed s
Require: Max steps K = 100, Learning rate x 10-3 Success threshold T = 0.5 Require: Preprocessing function P(-). Loss function ((s, y) BCEWithLogitsss y)
1: Set random seed using
2: Initialize 27
(0) .0) NN I); 2 2T
3: zadv None
4: for = 0 to K do
5:
(k) + SD c)
Generate image (35 inference steps)
anv Ds(P(z))) (+)))())) Get detector logit (P(-) includes postprocess & Kornia transforms)
(k)
6:
I. (k) ((sudv= 0)
7:
adv
8:
if (s adv ) < r then
(R)
9:
adv + 2T detach()
opt
break
11: end if
L
(K) adv
27
2T
199
SGD update
14: end for
Ensure: Resulting zgdv if attack succeeded, otherwise None.
Generator and Detector Setup. We used Stable Diffusion v1.4 (Comp Vistiiitaaaleddifftiooo---// via Hugging Face Diffusers) as the frozen generator SD. Attacks targeted our baseline ResNet50 [44 and CLIP+Linear (33) detectors, which were pre-trained on the SDv1.4 .4 GenImage subset.
Input Initialization. For each attack, text prompt e formatted "photo of [ImageNet La- bel]", using labels from ImageNet-Ik 77] The initial latent noise _0)) was sampled from M /) with shape (1, 64, 64) and dtype=torch. float16 Reproducibility for each attempt was en-
sured using torch. cuda. manual seed (seed_ count)). This initial tensor z(() was wrapped in Porch.nm.Parametr
torch. mn. Parameter to enable gradient computation and designated as the optimizable variable .ppt
Optimization Loop Details. The optimization proceeded for maximum of K 100 steps. each step k:
Generation: The current latent 2T
(k) input the frozen SD pipeline (pipe) with The resulting UNet output la-
output_type- ttpptyyppttttte 'latent' and num inwerence_stees--eeeeeeeeeeeeeee tents were scaled (/ pipe. vae. confi ig scaling (actor) factor) and decoded using the frozen VAE decoder (pipe. vae..vave.eee vae. decode) into an intermediate image tensor, which was then cast torch. float32.
Preprocessing P(-): The decoded image tensor underwent two stages of preprocess- ing. First, a custom postprocess function was applied: the image was denormal- ized to 1] (via 0.5 0.5 and clamping), scaled to [0, 255], subjected to simulated precision loss mimicking paa-tt--iint--to-foo conversion using the opera- tion image image. (ound .detacc()) image detach() (),, and finally rescaled [0, 1]. This step aimed to simulate realistic image saving/loading artifacts. Sec-
14

---

ond, standard detector-specific preprocessing (diseriiiiatoo_ppppprocc)) was ap- plied using the Kornia library [9] to ensure differentiability. This involved resiz- ing the image tensor to 224 x 224 pixels (K. (K.Resize.... align_ corners=False, antialias=True) followed by K. CenterCrop and normalizing it using the stan- dard CLIP statistics (K. MK.Nomaalize (mean- (1....14........................ 0.4578.... 0. 0.4082..... O. 0.2757...
std=(0.2686..., 0. 0.2613....
Loss & Optimization: The preprocessed image was passed through the frozen de- tector Da to obtain the logit sdv. The adversarial loss (k) was calculated using torch, nn BCEWithlogitssoss with a target label of Gradients V L were com- puted via backpropagation through the entire differentiable path (detector, Kormia prepro- cessing, custom postprocessing, VAE decoder, diffusion steps). The latent 27 was updated using torch. optim. SGD with a learning rate x 10 10-3.
Termination and Output. The optimization loop terminated if the success condition oss (dy < 0.5
(K')
was met or after used to generate the final adversarial image x = SD( (D(p c). which was saved as a PNG file. We iterated through seeds for each prompt until successful adversarial example was generated, collecting a total of N = 6000 examples for the Xadv dataset.
100 steps. If successful at step K', the resulting latent 21 = 2T was
Environment. Experiments were conducted using PyTorch Kornia 0.8.0, and single NVIDIA A100 GPU with CUDA 12.4.
Diffusers 0.33.0.devO,
A.2 Adversarial Training Fine-tuning Details
This section details the process used to fine-tune the baseline detectors using the generated on- manifold adversarial examples (Xadv).
Objective. The goal was to improve the robustness and generalization of the initial baseline detectors (ResNet50 and CLIp+Linear, pre-trained on SDv1.4 1.4) by further training them dataset augmented with the N 6000 adversarial examples Xadv generated as described in Section A.1
Dataset Composition. The training dataset was formed by combining the original SDv1.4 1.4 training from Genlmage 488] (real images labeled y SDv1.4 fakes labeled y 1) with the full set of N = 6000 adversarial examples Xadv (also labeled as fake, y = 1). Standard Py PyTorch Dataset and DataLoader classes were used, with the adversarial examples loaded via separate dataset instance and iterated through alongside the standard data within each epoch, as shown in the train_epock function structure. The combined dataset was shuffled for training.
Common Training Parameters. Key parameters applied across most fine-tuning runs include:
Optimizer: Adam
Weight Decay: x 10-4
Loss Function: Binary Cross-Entropy with Logits (torch. nn. ww..Be/iihhoogitss.oss))
Epochs: 20.
Adversarial Weighting: The loss contribution from adversarial samples (r E Xaav) was dynamically weighted using Aadv = min(1.1 (1.0 + 0.2 x epoch, 3.0), linearly increasing the emphasis on adversarial samples from 1.2 up to 3.0 over the first 10 epochs, then capping at 3.0.
Checkpointing: Model checkpoints were saved after each epoch. The "best model" was selected based on combined score: 0.6 x Val Acc + 0.4 x Adv Sample Acc, where Avg Val Ace is the accuracy on SDv1.4 .4 validation set, and Adv Sample Ace is the accuracy on the Xady set itself evaluated after each epoch.
Model-Specific Fine-tuning Strategies.
ResNet50 (Full Fine-tuning): The entire baseline ResNet50 detector was fine-tuned end-to- end using the augmented dataset. The learning rate was set to x 10-4 and batch size 128. Input images were preprocessed using Kornia 9 for resizing/cropping to 224 x 224 and normalization with standard ImageNet statistics (mean=[0.485,, 0.456, 0.406), (td29. 0.224, 0.225]).
15

---

CLiP+Linear (Full Fine-tuning): The entire CLIP ViT-L/14 backbone and the linear head
were fine-tuned end -oo-end using the augmented dataset. Learning rate and batch size were likely similar to the ResNet50 setup. Preprocessing used CLIPPs statistics and 224 x 224 resolution (Section A.
CLiP+Linear (Linear Only): Only the final linear classification head was fine-tuned using the augmented dataset. The CLIP backbone remained frozen. Learning rate and batch size were likely similar to the ResNet50/Full FT setup [Confirm LR/BS if different]. Preprocessing used CLIP's statistics.
CLIP+Linear (LoRA+Linear); LoRA 18] was applied to the CLIP ViT-L/14 back- bone while simultaneously fine-tuning the linear head. We used the PEFT library with LoraConfig set for TaskType. FEATURE, EXTRACTION. Experiments were run with LoRA SEATUTE
ranks {4, 8, 16}. The LoRA alpha was set to modules were "q_proj"; "v "v_proj", "k_ "k_proj" "out proj_. The learning rate for this strategy was 2 10-1 and batch size was 32. Preprocessing used CLIP's statisties.
x dropout was 0.1, and target
B Additional Results for On-Manifold Latent Attack
This section provides further analysis of our proposed on-manifold latent optimization attack, focusing on the quality of the generated adversarial images and characteristics of the optimized latent noise vectors.
B.1 Qualitative Analysis and Image Fidelity
A key characteristic of our on-manifold attack, which perturbs the initial latent noise 27 rather than directly manipulating pixel values rendered image, its ability to maintain high visual fidelity and semantic coherence with the input prompt Unlike traditional pixel-space attacks where perturbations might appear as noise, our method guides the generator SD to produce images that are still within its learned manifold but possess subtle characteristics that fool the detector.
Driginl Gotimibe Images
Dersat
0.2
Oytimded: mesiiod0 1814, stdwo 9992 1.66
23 24
26
28
20
Figure 4: Distribution of CLIP scores for images generated from original random latent noise (=Fand) versus optimized adversarial latent noise (=gdv) for the prompt "photo of cat". The close similarity in distributions and mean scores (Original: mean=28.00 00,, std=0.83; Optimized: mean=28.1 18, 18, std=0.96; Mean Difference: 031,, based [Number] samples) indicates that the latent optimization process preserves image fidelity and prompt alignment.
To quantitatively assess image fidelity and alignment with the prompt, we computed CLIP scores [3 [7 between the generated images and their corresponding text prompts. We com- pared the distributions of CLIP scores for images generated from original random latent noise ztand (before optimization, detectable by the baseline detector) with those generated from the optimized adversarial latent noise 2adv (after successful attack, fooling the baseline detector). Figure illuttrtess the CLIP score distributions for the prompt "photo of [ImageNet Label]" based on 6000 pairs of
16

---

original and optimized images. The distribution for optimized (adversarial) images largely overlaps with that of the original images. The mean CLIP score for original images was 28.05 (std=0.83). while for the optimized adversarial images it was 28.15 18 (std=0.96), resulting in mean difference of only 0. 13. This minimal difference and substantial overlap indicate no significant degradation in perceived image quality prompt alignment due to the latent optimization process. Similar trends were observed across other prompts.
Figure Comparison of adversarial examples for the prompt "photo of a cat" across multiple initial generations (columns). Rows from top to bottom: Original generated images, pixel-space attack samples (FGSM), and our on-manifold adversarial samples. Our on- on-manifold attacks fool the detector while preserving intrinsic generative artifacts, unlike pixel-space attacks that often introduce disruptive noise.
Figure 8 provides qualitative comparison across multiple ImageNet labels, showcasing images generated using various Loe-bounded pixel-space attacks (FGSM, PGD, MI-FGSM with different c values) alongside examples from our on-manifold latent optimization attack. As can be observed, pixel-space attacks, particularly higher values (e.g., e = 0.1), often introduce noticeable, somewhat unstructured noise patterns across the image. While these perturbations are bounded and may be "'iperceptible" appear artificial noisy. In contrast, the images generated by on-manifold attack (rightmost column for each label) maintain a high degree of visual realism and coherence consistent with the output of the Stable Diffusion generator. The differences from an original, non-adversarial generation (not explicitly shown aide-by-side here, but understood to be visually similar to the on-manifold attack output) typically semantic structural (e.g.. slight changes in pose, background detail, lighting, or object features), rather than additive noise. This visual evidence further supports the claim that latent optimization produces mn-aaiffold adversarial examples that preserve image quality while effectively fooling the detector.
the sense not drastically changing the overall scene, their texture can
B.2 Analysis of Optimized Latent Noise Vectors
To investigate whether the optimized adversarial latent vectors 27dh occupy distinct region or cluster within the latent space compared the initial random noise vectors zfaad we conducted focused experiment. Using the prompt "a photo of a cat", we performed our latent optimization attack targeting the baseline CLIP+Linear detector for 200 unique random seeds Stforchmmnual_seeee "torch. manual sccd((1))d))) Each attack was limited to maximum of K 50 optimization steps.
to
Out of the 200 attempts, 164 seeds resulted in successful adversarial latents agdv within the 50- step budget. We then collected all 200 initial random latents ztand (Original Latents) and the 164 corresponding successful adversarial latents 2 advv (Optimized Latents). To visualize their distribution, we applied t-SNE to project these high-dimensional latent vectors (shape 4 x 64 x 64, flattened) into a 3D space.
17

---

Lubent Space Cluaters (TEME)
Gomgoren
Figure 6: 3D I-SNE visualization of initial random latent vectors (zifadd blue circles) and successfully optimized adversarial latent vectors (2gdV, pink 'x' markers) for the prompt "a photo of cat". The lack of distinct clustering indicates that optimized latents are not confined a specific sub-region but interspersed among the original random latents.
The resulting visualization is shown in Figure 6 As be seen, the Optimized Latents (marked with "x") do not form distinct, well-separated clusters from the Original Latents (marked with 'o"). Instead, the optimized adversarial latents appear to be intermingled with and distributed similarly to the initial random latents. This suggests that successful adversarial perturbations do not necessarily push the latents into far-off, specific region of the latent space. Rather, they represent relatively small deviations from the initial random points, sufficient to cross the detector's decision boundary.
This observation is consistent with the notion that the detector's decision boundary is brittle and that many points on the generator's manifold are close to "adversarial pockets" reachable via minor latent adjustments. The lack of clear clustering for 2adv further implies that the vulnerability exploited is not tied to a single, easily characterizable sub-distribution of "bad" or "outlier" initial latents. Instead, it suggests that the standard detector fails to robustly interpret subtle variations across broad range of typical initial latents 2Fand The issue is not that only certain types of initial latents are problematic, but rather that the detector's 's learned features originating from many diverse starting points in the latent space. This reinforces the idea that the detector relies non-robust "shortcut" features that can be easily masked manipulated through these nuanced latent perturbations.
sensitive small, targeted changes
C The GenImage++ Benchmark Dataset Construction
This appendix details the motivation, design, and construction of Genlmage++ benchmark dataset.
C.1 Motivation and Design Goals
While the GenImage dataset (48] provides a valuable baseline, its constituent models predate signifi- cant recent advancements. To offer a more contemporary and challenging evaluation, we developed Genlmage+++. Our design addresses two primary dimensions of progress generative Al: (1) Ad- vanced Generative Models, incorporating outputs from state-of-the-art architectures like FLUX.1 and Stable Diffusion 3 (SD3), which utilize Diffusion Transformers (DiT) and powerful text encoders (c.g.. T5-XXL); and (2) Enhanced Prompting Strategies, leveraging the improved prompt adherence
18

---

and diverse generation capabilities of these modern models. Genlmage++ is a test-only benchmark designed to rigorously assess AIGC detector generalization against these new capabilities.
C.2
Generative Models Used
The following generative models were used, sourced from Hugging Face Transformers and Diffusers
libraries:
FLUX.1-dev: black-forrett-Lass/UUU 1-dee 20
Stable Diffusion Medium (SD3): http://ltppp//cccaaaccaaaoooaoaa
10]
Stable Diffusion XL (SDXL): pttp::itppp//ataallllaafaaaaaaaa
[1].
Stable Diffusion v1.5 (SD1.5): nunaayall/ttabbeeddffffsssoooo//
For FLUX. 1-dev and SD3, images were generated at 1024 x 1024 resolution using 30 inference steps, guidance scale of 3.5, and a maximum sequence length of 512 tokens, unless specified otherwise.
Parameters for SDXL and SDI.5 followed common practices for those models.
flux
RUK realittc
flux photo
flux multistyle
sdv1 multistyle
5dxt style
crable_diflusion
Saable_difussion. r'rellsstic
jable_diffusion... 3_ophhhtooo
Figure 7: Sample images from multiple subsets of the Genlmage++ dataset. Each block (from left to right, top bottom) shows examples generated by different models and style presets: (a) Flux, (b) Flux realistic, (c) Flux photo, (d) Flux multistyle, (e) SDv1.5 multistyle, (f) SDXL style, (g) Stable Diffussion v3.0, (h) Stable Diffusion v3.0 realistic, and (i) Stable Diffusion v3.0 photo. This figure illustrates the visual diversity across models and styling configurations in our dataset.
19

---

C.3 Subset Construction and Prompt Engineering
Genlmage++ comprises several subsets, each with distinct prompt engineering strategies, leveraging
Meta-Llama-33 3.1.3..... 1-8B-Inn Inssruutttt aattaallaaaaaaaaa L1 ama- -3 -----IInsttttt [3 for prompt expansion where noted. The scale of each generated subset detailed Table
Table 7: Number of images in each subset of the Genlmage++ benchmark.
Subset
Flux
Flux_multi
Flux_photo
Flux_real
SDI.5_mult
SDXI_multi
SD3_photo
SD3_rea)
Images
6k
18.3k
30k
6k
18.3k
18.3k
6k
30k
6k
Base Subsets (Flux, SD3):
Target: Baseline performance on FLUX.1 and SD3.
Prompting: Following the Genlmage protocol, "photo of [ImageNet Label]" using labels from ImageNet-Ik 77.
Scale: 6000 images per model (see Table 7
Realistic Long-Prompt Subsets (Flux teaussstiittie, r
Target: Long-prompt prompt comprehension and detailed scene generation.
Prompting: ImageNet labels were expanded by Llama-3.1 using the system prompt: "You are now a text-to-image prompt generator. For the given ImageNet class labels, integrate them into more harmonious and detailed scenes. Provide the prompt directly without any additional output." The ImageNet label was then provided as the user message.
Scale: As per Table 7
Example: Label: Goldfish "In serene Zen garden, majestic goldfish swims majesti- cally in a tranquil pool crystal-clear water, surrounded by intricately raked moss and stone formations that reflect the warm sunlight filtering through waterfall in the background." Label: White Shark -> "A colossal great white shark swimming effortlessly through crystal-clear, turquoise waters, surrounded by vibrant coral reef, teeming with an array of tropical fish, including iridescent blue damselfish and shimmering yellow tang, while sunny sky with puffy white clouds reflects off the rippling ocean surface.",
Multi-Style Subsets (Flux multistyle, SDXL multistyle, SD1.5 multistyle):
Target: Style diversity and adherence.
Prompting: Based on 183 style templates from the ComfyUI MilcHighStyler repository"
For each style template (which contains a placeholder for a scene), Llama-3.1 generated a fitting scene description using the system prompt: "I have style description that contains placeholder for a specific scene, marked as [[prompt)] ). Please provide a detailed and vivid description to fill in this placeholder. Only return single scene description for { ((rommpt), ). without including any additional text or references to the style or the prompt itself. Style: [original style template from JSON file]".
Scale: 100 images per style for each of the 183 styles, totaling 18,300 images per model (Flux, SDXL, SD1.5). Style compatibility for FLUXX1 1 was referenced from community- maintained lis
Example: "name": "sai-origamii, "prompt": "origami style In a tranquil morning mist, delicate petals unfold like gentle lover's whisper, as if the very essence of cherry blossoms had been distilled into this exquisite origami piece. Soft pink hues dance across the intricate pleats, evoking the tender promise of spring's awakening. The delicate flower, masterfully crafted from layers of pleated paper, rises from the serene landscape like a whispering prayer. Each fold and crease has been carefully crafted to evoke the subtle nuances of nature's beauty, its beauty so captivating that it appears almost lifelike. Its central axis, slender stem, supports the delicate blossom, guiding it upwards with elegance that
sty styles, les, leelee__ttat sson
20

---

belies the complexity of its creation. Around it, the gentle curves of the paper seem to blend seamlessly with the misty atmosphere, creating an ethereal balance between the organic and the man-made. The overall composition is testament to the timeless beauty of origami art, where the simplicity of single piece can evoke a profound sense of serenity and wonder, inviting the viewer to pause and appreciate the intricate beauty that unfolds before them... paper art, pleated paper, folded, origami art, pleats, cut and fold, centered composition", "name": hartstyl-grrffiii "prompt": "graffiti style The city's concrete heart beats stronger under the vibrant glow of a street art haven. Amidst a maze of alleys, where the city's underbelly roars to life at dusk, towering mural sprawls across worn brick wall. "Phoenix Rising" the mural's bold title is emblazoned across the top in fiery red and orange hues, its letters splattered with an explosive mixture of colors that dance like flames. Below, majestic bird bursts forth from the ashes, its wings outstretched, radiating a kaleidoscope of colors- sapphire, emerald, and sunshine yellow. In the background, a cityscape is reduced to smoldering embers, the remnants of a ravaged metropolis that has been reborn through the unrelenting power of art. Skyscrapers, reduced to skeletal frames, pierce the night sky like splintered shards of glass. Smoke billows from the rooftops, but amidst the destruction, phoenix rises. Its eyes, like two glittering opals, seem to shine with inner light, if the very essence of rebirth has been distilled within its being. The mural's tag, signed in bold, sweeping script as "Kaos", runs across the bottom of the image, rebellious declaration of the artist's intent: to shatter the conventions of urban decay and bring forth radiant new world from the ashes. The colors blend, swirl, and merge, creating an immersive experience that defies the boundaries between reality and fantasy. "Phoenix Rising" stands as a testament to the transformative power of street art, a beacon of hope in a city that never sleeps, mural that whispers to all who pass by: "Rise from the ashes, for in the darkness lies the seeds of rebirth." " street art, vibrant, urban, detailed, tag, mural",
High-Fidelity Photorealistic Subsets (Flux siixx_phto,,aoo SD3 DD3_photo):
Target: High-quality photorealism, including human portraits.
Prompting:
Prompts were generated by Llama-3.1 based on a structured template inspired by community best practices for detailed photo generation. The template format was: '[STYLE OF PHOTO] photo of a [SUBJECT), [IMPORTANT FEATURE), [MORE DETAILS), CEETTIINGBAGGGRUUNNE
[POSE OR ACTION], [FRAMING], ERA ANGLEJ, [CAMERA PROPERTIES) in style of SHOOTOGRAPHERS Llama-3.1 filled these placeholders randomly using the system instruction: "You are prompt generator for text to image synthesis, now you should randomly generate a prompt for me to generate image. The prompt requirements is: prromptforrmat Prompt only, no more additional reply".
[LIGHTING), (CAM-
Scale: As per Table 7
Example: "Moody black and white photo of a woman, dressed in a flowing Victorian-era gown, holding delicate, antique music box, standing on worn, wooden dock, overlooking a misty, moonlit lake, with a faint, lantern glow in the distance, in the style of Ansel Adams."
"High-contrast black and white photo of majestic lion, with a strong mane and piercing eyes, standing proudly on a rocky outcrop, in mid-stride, with the African savannah stretching out behind it, bathed in warm golden light, from low-angle camera perspective, with wide-angle lens, in the style of Ansel Adams." "
C.4 Rationale as a Test-Only Benchmark
Genlmage++ is intentionally a test-only dataset and does not include corresponding real images for each generated category. This design choice is due to several factors:
1. Copyright and Sourcing Challenges: Sourcing perfectly corresponding, high- quglituality real images for the vast array of styles, complex scenes, and specific portrait attributes generated by modern models poses significant copyright and practical challenges, especially avoiding the use of web-scraped data that may itself contain Al-generated content or copyrighted material. Using reverse image search is often infeasible for highly stylized or uniquely composed generations.
21

---

2. Focus on Generalizable Artifacts: Our primary aim is to test a detector's s ability to identify intrinsic generative artifacts (fgnn) that are independent of specific semantic content.
For the Base Label and Realistic gories are largely derived from ImageNet, for which abundant real image counterparts already exist within the original Genlmage dataset and other standard vision datasets.
subsets, the underlying semantic cate-
For the Multi-Style subsets, our experiments (Section show that detectors trained on SDv1. .4 can easily generalize to SDv 1--ggeneeee styles but struggle immensely with styles from Flux or SDXL. This suggests the difficulty lies not recognizing the styled semantic content (which would be c-dependent feature) but in identifying the differing generative artifacts of the underlying models.
Therefore, Genlmage++ serves as robust benchmark for evaluating a detector's generalization to new generator architectures and advanced prompting techniques, focusing on the detection of AI-specific fingerprints rather than simple real-vs-fake comparison on matched content. Beyond the generated images themselves, all code used for data generation, along with the structured JSON files containing the prompts for each subset, will made publicly available to facilitate further research and benchmark replication.
D
Extended Discussion and Future Directions
D.1 Broader Relevance of Robustness to Latent Perturbations
The robustness against perturbations initial latent space 27 holds significance beyond detecting standard text-to-image outputs generated from purely random noise. Several increasingly common AIGC tasks involve non-standard or optimized initial latent variables:
Image Editing and Impainting: These tasks often initialize the diffusion process from a latent code obtained by inverting real image, potentially modifying this latent before generation
(2
Optimized Initial Noise: Recent work focuses on finding "better" initial noise vectors 2y than random Gaussian samples to improve generation quality or efficiency, sometimes referred "golden noise" 44).
A detector solely robust to outputs from standard Gaussian noise 2tand might be vulnerable when encountering images produced these scenarios. Therefore, by adversarially training our detector 2Adv we not only aim to improve generalization by
using examples derived from optimized latents 2T" forcing the learning of f gen. but also potentially enhance the detector's applicability and robustness across this wider spectrum of AIGC tasks that utilize non-standard latent initializations. This presents an interesting avenue for future investigation.
D.2 Limitations
While our proposed on-manifold latent optimization attack and subsequent adversarial training demonstrate significant improvements in AIGC detector generalization, we acknowledge certain limitations in the current study.
Computational Cost of Latent Optimization Attack. Our white-box attack methodology, which optimizes the initial latent noise 27, requires maintaining the computational graph through each denoising step of the diffusion model to backpropagate gradients from the detector's 's loss back to ÆT- This incurs substantial VRAM cost. For instance. attacking detector using Stable Diffusion v1.4 with 35 denoising steps consumed approximately 79GB of VRAM on an NVIDIA A100 GPU. This high memory requirement currently limits the scalability of generating very large adversarial datasets using this specific attack technique or applying it to even larger generator models without access to high-end hardware.
Requirement for Differentiable Preprocessing and Detector Retraining. ensure end-to-end differentiability from the detector's loss back to the initial latent all intermediate image prepro- cessing steps (e-g., resizing, normalization) must also be differentiable. our implementation, this necessitated the use of libraries like Kornia 9 for these transformations, rather than potentially
22

---

more common, non-differentiable pipelines involving libraries like Pillow or standard 'torchvi- trantranffomm' they break the gradient chain during the attack generation. Consequently, when generating adversarial examples against specific target detector, or when performing adversarial training, the detector ideally needs to be trained or fine-tuned within a framework that utilizes such differentiable preprocessing (as our baseline detectors were). This can limit the direct "out-of-the box" application our attack generation process to arbitrary pre-trained third-party detectors if their original training and inference preprocessing pipelines are not fully differentiable or easily replicable with differentiable components. While we retrained baselines like ResNet50 and CLIP+Linear within this bornia-based framework for fair evaluation and adversarial training, evaluating wide array of externally tre-trained detectors (whose exact preprocessing might be unknown or non- conn-ifferentiable) with our specific latent attack would require re-implementing adapting their input pipelines.
Future work could explore methods to reduce the VRAM footprint of the latent attack, perhaps through gradient checkpointing within the diffusion model during attack by developing more memory-efficient approximation techniques. Additionally, investigating strategies to adapt our latent attack or on-manifold adversarial examples to detectors with non-differentiable preprocessing pipelines could further broaden the applicability our findings.
D.3 Broader Impacts
The research presented in this paper aims to advance the robustness and generalization of AIGC detection, which crucial for mitigating potential misuse of Al-generated content, such as disinfor- mation or non-consensual imagery. By identifying and addressing vulnerabilities like latent prior bias, we hope to contribute to more reliable forensic tools.
However, as with any research involving adversarial attacks, there is a potential for the attack methodology itself to be misused. The on-manifold latent optimization attack described could, in principle, be employed by malicious actors to craft AIGC that evades detection systems. We acknowledge this possibility but believe the direct negative impact of our specific attack method is likely limited due to several factors:
White-Box Requirement: Our attack is a white-box method, requiring full access to the target detector, including its architecture, weights, and the ability compute gradients with respect to its inputs. This significantly restricts its applicability against closed-source or API-based detection services where such access
available.
Computational Cost: discussed in Section D.2 generating adversarial examples via latent optimization is computationally intensive, particularly in terms of VRAM. This may act as a practical barrier for large-scale misuse by those without significant computational resources.
Furthermore, the primary contribution of this work lies in using these attacks diagnostic tool to understand detector weaknesses (latent prior bias) and subsequently as a means to improve detector robustness through on-manifold adversarial training (OMAT). The insights gained are intended to strengthen defenses, and the OMAT paradigm itself offers a pathway to more resilient detectors. We will also make our GenImage++ benchmark publicly available, which will aid the community in developing and evaluating more robust detectors against contemporary generative models.
23

---

harmefet
Label
Sramraling
haar
B400
Figure 8: Qualitative comparison of adversarial examples generated for various ImageNet labels. Each row corresponds to different label. Columns display results from different L -bounde pixel-space attacks (FGSM, PGD, MI-FGSM with varying e) and our proposed on-manifold latent optimization attack (rightmost column). Pixel-space attacks often introduce visible noise, especially at higher e, while our on- on-manifold attack maintains high visual fidelity consistent with the generator's capabilities.
24

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: In the abstract and introduction, we state "we propose On-Manifold Adversarial Training and demonstrate SOTA generalization three AIGC benchmarks," which exactly matches the experiments in Sec.5 and the theoretical discussion in Sec.3 and 4.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: We discuss our limitations in Appendix D.2 noting that our prepro- cessing pipeline relies on Kornia to propagate gradients unlike standard torchvi- sion. transforns which necessitates retraining the attacked detector.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged
the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
25

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
Justification: Our work is purely empirical and does not include any formal theoretical results or proofs.
Guidelines:
The answer NA means that the paper does not include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We provide comprehensive experimental details in Appendix A including attack hyperparameters, adversarial training settings (learning rate, epochs, batch size), and configurations used for baseline comparisons.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, other means that are appropriate to the research performed.
specific model and empirical evaluation, may
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how reproduce that algorithm.
(b) If the contribution primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution a new model (c.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibilityy may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibiliity In the case of closed-source models, it may be that access to the model is limited in
26

---

some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [No]
Justification: To preserve anonymity, we will release all code, data, and reproduction
instructions upon acceptance; all results have been independently reproduced by second researcher.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cm cc/ gublic/guidess oot.e/eeuuummiiiiiooooooiiooiiie
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
//nips. http/uullcggguucee Cooee///ddSSSbsssseee ssionooicyy for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We provide comprehensive experimental details in Appendix A including attack hyperparameters, adversarial training settings (learning rate, epochs, batch size), and configurations used for baseline comparisons.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: report metrics averaged over multiple independent runs to support robust- ness, but have omitted explicit error bars in this version due to space constraints; we will include full variability analysis with standard deviations in the supplemental material and public code relcase.
27

---

Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CL, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
The manuscript discusses the computational resources required, particularly for the adversarial attack generation (c.g., VRAM consumption on specific hardware), in the Limitations section (Section D.2).
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics h
Answer: [Yes]
Justification:
We confirm that our research fully adheres to the NeurIPS Code of Ethics
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative socictal impacts of the work performed?
28

---

Answer: [Yes]
Justification: We outline positive effects (e.g., more robust AIGC detection) and negative misuse risks (e.g., enabling better deepfake creation) in Appendix D
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g.. deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our work does not release any pretrained models or scraped datasets with high misuse risk.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We reference the open-source models we use in the generation process of our dataset in Appendix
Guidelines:
The answer NA means that the paper does not existing assets.
29

---

The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license ge.g.. CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, pappessitthheeeocc thoode com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-pase re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We introduce a AIGC Image dataset and provide its detailed schema, usage instructions, and metadata in Appendix; full documentation will accompany the public release.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Our work does not involve any crowdsourcing experiments or human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
30

---

Justification:
Our work does not involve any human subjects or user studies.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality the research, declaration is not required.
Answer: [Yes]
Justification: We used Llama3.2 2 to augment and diversify dataset prompts during data construction, as detailed in Appendix.
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should be described.
wwweeriisscccooffeeee /c//oonferencce/22255////////// LLMML
31


Reviews:
[{"review_id": "jPnzkogN4Y", "reviewer": "Reviewer_jB2U", "summary": "The paper tackles the well-known poor cross-generator generalization of AI-generated-image (AIGC) detectors. The authors introduce On-Manifold Adversarial Training (OMAT), which uses optimized latent seeds to generate realistic adversarial examples and retrain detectors. This approach significantly improves cross-generator performance without changing model architecture. A new benchmark, GenImage++, demonstrates OMAT’s strong generalization to advanced generative models.", "questions": "- The authors could consider comparing with recent universal detectors such as RIGID on GenImage and GenImage++, and evaluating whether the OMAT-trained detector remains robust when test images are further perturbed by latent-space evasion attacks such as StealthDiffusion.\n- Since the detector is trained only on SD v1.4 images, the reported improvements may stem from increased exposure to hard negatives rather than from a true mitigation of latent prior bias.\n\nPlease refer to the weaknesses above for additional questions and suggestions.", "limitations": "yes", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n- The paper clearly articulates the notion of “latent prior bias” and illustrates it with a white-box latent-space attack that is easy to understand and implement.\n- Empirical results on both the standard GenImage benchmark and the newly curated GenImage++ set show noticeable gains in cross-generator accuracy.\n\nWeaknesses:\n- On-manifold adversarial training was proposed and discussed in [31] and Xiao et al. “Understanding Adversarial Robustness Against On-manifold Adversarial Examples.” The paper is the first to apply it to AIGC detection, but the conceptual novelty is incremental.\n- There is no formal proof connecting “latent prior bias” to generalization; the evidence presented is purely empirical.\n- Ablations vary LoRA rank and compare with pixel-space FGSM/PGD/MI-FGSM, but critical factor such as attack steps, step-size, guidance scale are not ablated.\n- The attack used to generate training data assumes white-box access and requires approximately 79 GB of GPU memory per image, which makes the threat model unrealistic for most real-world adversaries.", "was_revised": true, "final_justification": "I appreciate the detailed rebuttal, but the core concerns remain. The central claim that “latent prior bias” is the key driver of poor cross-generator generalization and that OMAT mitigates it remains largely empirical and not yet causally established, as the observed gains could plausibly still result from targeted “hard negatives.” The threat model is weak: the white-box, full-pipeline latent optimization is unrealistic for most adversaries, and robustness to black-box or semantic-latent attacks (e.g., StealthDiffusion-style) remains untested. The additional experiments (new SOTA comparisons, GAN results, budget scaling) help the narrative but are not included in the paper and cannot be thoroughly verified during the rebuttal phase. Finally, the dependence on a differentiable preprocessing pipeline limits applicability to deployed detectors. I intend to keep my original rating.", "rebuttal": "We sincerely thank Reviewer jB2U for their detailed feedback. We are encouraged that they found our paper clear and our empirical results significant. Their critiques have helped us sharpen our core contributions. We believe the concerns raised stem from a misunderstanding of our central thesis: our work is not an incremental application of adversarial training, but the **discovery and targeted mitigation of a novel, fundamental vulnerability in AIGC detectors.**\n\nWe address the reviewer's points below and are confident that our clarifications and new results will merit a re-evaluation of the score.\n\n### **1. On Novelty, Evidence, and the \"Hard Negatives\" Hypothesis**\n\nWe thank the reviewer for this crucial point, as it allows us to clarify the unique context of our work. While the term \"on-manifold adversarial training\" exists, its meaning and application here are fundamentally different because the **core problem in AIGC forensics is different.**\n\n**The Central Challenge & Our Contribution:** The paramount challenge in this field is the \"generalization gap,\" where detectors learn generator-specific \"shortcuts\" instead of fundamental AI fingerprints (e.g., from a common VAE decoder). Our work identifies a more insidious shortcut: **\"latent prior bias\"**, where detectors overfit to artifacts arising from the unique initial noise prior `z_T` of the training generator.\n\n**Why Our \"On-Manifold\" Approach is Fundamentally Different:** This leads to the critical distinction between our work and prior on-manifold literature (e.g., Stutz et al. [2], Xiao et al. [1]):\n*   **Prior work addresses intra-manifold classification** (e.g., robustly classifying \"5\" vs \"6\"). Their attacks perturb the *learned semantic latent code `z=enc(x)`* along an *approximated* data manifold.\n*   **Our work addresses inter-manifold discrimination** (real vs. fake). We leverage the *exact, known generative function* to perturb the *content-agnostic initial prior `z_T`*.\n\nTherefore, prior work asks, \"Is the classifier robust to small semantic changes?\" We ask, \"Is the detector robust to the non-generalizable artifacts of the generative process itself?\" Our central hypothesis is that by leveraging our access to the exact generator manifold, we can design on-manifold attacks that specifically expose and penalize the detector's reliance on z_T-influenced shortcuts. This forces the model to learn the more subtle but truly fundamental fingerprints of AI synthesis (like those from the VAE decoder), which is the key mechanism through which OMAT achieves its unprecedented cross-generator performance.\n\n**Empirical Evidence vs. the \"Hard Negatives\" Hypothesis:** We acknowledge that our work is primarily empirical. To provide strong causal evidence for our claims and disprove the excellent alternative hypothesis—that improvements may stem from generic \"hard negatives\"—**our experiments in Table 5 were designed for this exact purpose, and the results are decisive:**\n*   Pixel-space attacks create \"hard negatives\" but provide only a marginal gain (Avg. Acc improves from 79.19% to ~83%).\n*   Our On-Manifold Attack, which directly targets latent prior bias, yields a massive gain, catapulting accuracy to **94.63%**.\n\nThe **>11% performance gap** causally isolates the impact of mitigating latent prior bias, a flaw that cannot be fixed by simply adding generic \"hard negatives.\" This empirical finding is further supported by emerging work on \"golden noise\" (Zhou et al. [3]), which confirms the optimizable structure of the initial latent space. Our work thus provides the crucial empirical validation for this emerging understanding.\n\nFinally, the power of this targeted approach is confirmed by its remarkable data efficiency. While methods like DRCT require massive data augmentation, **we achieve superior performance by adding only 6,000 targeted examples (<2% data increase).** This surgical precision proves OMAT is not generic augmentation; it is the direct and efficient solution to the `latent prior bias` we discovered.\n\n### **2. On Experimental Design, Rationale, and Efficiency**\n\nWe agree our white-box attack is a **diagnostic tool for defenders**, not a realistic threat model. The high computational cost is a one-time training investment, and our final OMAT-trained detector has **zero inference overhead**, unlike reconstruction-based methods.\n\n**Rationale for Ablation Choices & Memory Usage:** We thank the reviewer for the question about ablations and will clarify our rationale in the revision.\n*   **Guidance Scale:** This was a deliberate choice. We kept the `guidance_scale` and other generator parameters fixed to **scientifically isolate `z_T` as the sole experimental variable**, ensuring our results are directly attributable to latent prior bias.\n*   **Attack Steps & Step-Size:** As detailed in Appendix Alg. 1, our optimization goal is to *diagnose a fragility*, not to calibrate a specific attack strength like PGD. Since our attack succeeds rapidly for many samples (Fig. 2), we used a fixed, sufficient hyperparameter set and focused ablations on the more central question of comparing attack domains (Table 5).\n*   **Memory Usage:** The 79GB memory requirement is a direct consequence of our rigorous experimental design. To scientifically prove our hypothesis, we backpropagate the loss through the **entire, unaltered multi-step denoising process of the diffusion model.** This ensures that the gradients used to find the adversarial latent z_T are exact and that the resulting image is perfectly on-manifold. Our results in Appendix Fig. 6, showing adversarial and original latents are closely interspersed, suggest that more memory-efficient search strategies are viable for future work.\n\n### **3. Extended Benchmarking on GenImage++**\n\n*   **Comparison with SOTA Detectors:** Thank you for this excellent suggestion. We have conducted new experiments comparing our OMAT-trained model with several recent SOTA forensic methods on our challenging **GenImage++ benchmark**. We will add these extra comparisons into the final manuscript.\n\n**Table: Generalization performance (Acc %) on the GenImage++ benchmark. All models were trained only on SDv1.4 data.**\n|Model|Source|Flux|Flux Multi|Flux Photo|Flux Real|SD1.5 Multi|SDXL Multi|SD3|SD3 Photo|SD3 Real|**Avg**|\n|:--|:--|:--:|:--:|:--:|:--:|:--:|:--:|:--:|:--:|:--:|:--:|\n|**Our (CLIP+LoRA R4)**|-|**96.53**|**92.55**|**97.60**|**97.67**|**100.00**|**99.17**|**98.27**|90.38|**98.82**|**96.78**|\n|Our (LoRA R16)|-|97.93|89.48|99.44|96.25|100.00|98.30|98.56|91.50|97.28|96.53|\n|Our (LoRA R8)|-|97.48|85.88|95.19|96.45|100.00|94.53|98.02|95.66|96.98|95.58|\n|RIGID|arXiv'24 [4]|46.60|61.92|96.36|62.08|64.66|80.73|39.66|97.19|56.38|67.29|\n|c2p-clip|AAAI'25 [5]|0.66|0.21|0.00|0.14|41.78|18.66|1.51|0.20|0.13|7.03|\n|CO-SPY|CVPR'25 [6]|94.25|95.99|99.32|98.23|85.31|58.27|75.38|92.70|92.33|87.98|\n|RINE|ECCV'24 [7]|93.33|67.87|77.57|84.56|97.13|94.57|97.91|90.99|91.65|88.40|\n|PatchShuffle|NeurIPS'24 [8]|95.83|98.15|97.30|99.50|97.82|85.65|70.67|25.30|64.28|81.61|\n|FreqNet|AAAI'24 [9]|72.75|64.04|74.22|62.95|74.73|55.30|64.67|68.73|59.41|66.31|\n|AEROBLADE (LPIPS₂ @5%FPR)|CVPR'24[10]|91.70|84.43|64.47|82.43|82.93|65.87|64.70|51.93|54.07|71.39|\n\nRegarding the reviewer's question about robustness to latent-space evasion attacks like StealthDiffusion, this is a very insightful point and highlights an important distinction in attack methodologies. While our OMAT is designed to mitigate the process-level \"latent prior bias\" tied to z_T, attacks like StealthDiffusion operate differently. They use controlled VAEs and convolutions fusion to perform sophisticated semantic manipulations in a learned latent space, aiming to preserve visual quality while fooling a detector.\n\nWe attempted to reproduce StealthDiffusion to test our model's robustness, but encountered technical challenges with the implementation. However, based on its methodology, we hypothesize that our detector may not be inherently robust to this different class of attack. OMAT trains the model to ignore non-generalizable process artifacts, while StealthDiffusion crafts attacks based on semantic content. Defending against such sophisticated semantic evasion attacks is a distinct and important research direction, and we believe it is an excellent avenue for future work.\n\n[1] Xiao, J., et al. \"Understanding adversarial robustness against on-manifold adversarial examples.\" *Pattern Recognition* (2025). \n\n[2] Stutz, D., et al. \"Disentangling adversarial robustness and generalization.\" *CVPR* (2019). \n\n[3] Zhou, Z., et al. \"Golden noise for diffusion models: A learning framework.\" *arXiv* (2024).\n\n[4] He, Z., et al. \"Rigid: A training-free and model-agnostic framework for robust ai-generated image detection.\" *arXiv* (2024). \n\n[5] Tan, C., et al. \"C2p-clip: Injecting category common prompt in clip to enhance generalization in deepfake detection.\" *AAAI* (2025). \n\n[6] Cheng, S., et al. \"CO-SPY: Combining Semantic and Pixel Features to Detect Synthetic Images by AI.\" *CVPR* (2025). \n\n[7] Koutlis, C., & Papadopoulos, S. \"Leveraging representations from intermediate encoder-blocks for synthetic image detection.\" *ECCV* (2024). \n\n[8] Zheng, C., et al. \"Breaking semantic artifacts for generalized ai-generated image detection.\" *NeurIPS* (2024). \n\n[9] Tan, C., et al. \"Frequency-aware deepfake detection: Improving generalizability through frequency space domain learning.\" *AAAI* (2024).\n\n[10] Ricker, Jonas, Denis Lukovnikov, and Asja Fischer. \"Aeroblade: Training-free detection of latent diffusion images using autoencoder reconstruction error.\" *CVPR* (2024)."}, {"review_id": "HmcByUP5tD", "reviewer": "Reviewer_evQu", "summary": "The paper first uncovers a latent prior bias in AIGC detectors by crafting on-manifold white-box attacks that exploit the detector’s reliance on initial noise, demonstrating how this shortcut undermines cross-generator generalization. It then introduces On-Manifold Adversarial Training (OMAT), which augments detector training with zₜ-optimized adversarial examples to force the model to learn truly robust generative artifacts, yielding significant improvements in out-of-domain performance. Additionally, the authors introduce GenImage++, a challenging test-only dataset comprising outputs from advanced generators (e.g., Flux.1, SD3) produced with diverse prompting strategies.", "questions": "- Have you considered including an experiment that progressively increases the proportion of on-manifold adversarial examples during training? Such a study would clarify OMAT’s sensitivity to adversarial-sample scaling.\n\n - Could you clarify whether the text-conditioning pathway exhibits a similar latent-prior shortcut? In particular, have you applied on-manifold perturbations to the textual prompts and evaluated their impact on detector robustness?\n\n - Would you consider expanding the Related Work section to cover recent advances in latent-space forensic analysis, few-shot learning, and patch-based methods for AIGC detection?", "limitations": "yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 4, "originality": 4, "strengths_and_weaknesses": "- **Strengths**：  \n  - Identification of a Core Vulnerability: The paper identifies a significant vulnerability in existing AIGC (AI-Generated Content) detectors, which is the latent prior bias. This bias leads to detectors being overly reliant on specific latent features, making them susceptible to targeted attacks that exploit this weakness.\n\n  - Simple yet Effective Training Framework: To mitigate this bias, the authors introduce OMAT, which employs on-manifold adversarial examples for detector training. Despite its conceptual simplicity, OMAT directly addresses the identified shortcoming and delivers substantial performance gains.\n\n  - Sharp analysis of results: The paper is careful in dissecting why OMAT works, linking improved generalization to acquired robustness against the specific latent-based attacks. OMAT achieves superior cross-generator generalization compared to both traditional and state-of-the-art baselines. And the ablation in Table 5 (Section 6.6) is illustrative and shows that on-manifold adversarial examples result in much stronger generalization improvements compared to traditional pixel-space adversarial examples.\n\n- **Weaknesses**：  \n  - While the paper focuses on visual perturbations, it does not explore the potential of on-manifold adversarial attacks in the text-conditioning pathway. This could limit the applicability of OMAT to scenarios where text conditioning plays a significant role.\n\n  - Introducing a small experiment that gradually varies the number (or proportion) of on-manifold adversarial examples during training could help clarify how sensitive OMAT’s performance is to the adversarial sample budget. A brief analysis of performance trends as this budget increases would strengthen understanding of the method’s robustness.\n\n  - The Related Work section is somewhat narrow, covering only a few detector types that may be relevant to the shortcut proposed in this work.\n\n  - The attack framework depends on Kornia’s differentiable preprocessing, which may limit OMAT’s applicability to more diverse detectors.", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank the reviewer for their positive assessment and exceptionally constructive feedback. We are delighted they recognized our work's quality, originality, and significance. Their suggestions will undoubtedly help us strengthen the final manuscript. We address each of the reviewer's excellent points below. \n#### **1.  On Sensitivity to the Adversarial Sample Budget** This is an excellent question. Per the reviewer's suggestion, we have conducted a new experiment to analyze how OMAT's performance scales with the number of  on-manifold adversarial examples used in training. For this study, we fine-tuned the detector on different proportions of our 6,000 generated adversarial examples. The results on the GenImage benchmark are presented below: \n\n**Table: Ablation on the proportion of the 6,000 adversarial examples used for OMAT fine-tuning.**\n| % of Adv. Examples Used |  0%  |  10%  |  25%  |  50%  |  75%  |  100%  |\n| :-: | :-: | :-: | :-: | :-: | :-: | :-: |\n| Avg. GenImage Acc (%)   | 79.19 | 90.06 | 91.10 | 93.03 | 94.08 | 94.63  |\n\n The results show that OMAT's performance scales gracefully with the adversarial sample budget. Using just 10% of the generated examples (600 images) provides a remarkable **+10.87%** improvement in average accuracy. The gains continue to increase with diminishing returns as more samples are added, demonstrating that the method is both data-efficient and robust to the exact size of the adversarial set. This confirms that even a modest budget of on-manifold examples is highly effective at mitigating latent prior bias. \n \n #### **2. On the Text-Conditioning Pathway** This is a very insightful question. We did perform preliminary investigations into perturbing the text-conditioning pathway. However, we encountered two primary challenges: \n 1. **Optimization Instability:** The discrete nature of the text token space makes gradient-based optimization highly unstable, unlike the continuous space of `z_T`. \n 2. **Semantic Coherence:** Successful perturbations often resulted in images with poor visual quality and a noticeable misalignment with the original prompt, introducing confounding factors. \n \n In contrast, our `z_T` attack is stable and maintains perfect semantic coherence. We hypothesize that the text pathway is a less direct source of *non-generalizable, generator-specific* artifacts. The features from a text encoder (like CLIP's) are designed to be general, whereas the artifacts influenced by `z_T` are intimately tied to the specific architecture and implementation of the source generator. We therefore focused our investigation on `z_T` as the primary, most stable, and most direct source of the generalization-breaking shortcut.\n\n#### **3. On Related Work and Broader Applicability**\n\nThank you for these excellent suggestions. We agree and will expand the Related Work section in the final manuscript to better contextualize our contributions. In fact, motivated by your feedback, we have already conducted extended comparisons against several SOTA patch-based and latent-space forensic methods, the results of which are now included in our rebuttal. We will integrate a full discussion of these diverse approaches in the revised paper.\n\nRegarding the **applicability of OMAT**, the reviewer correctly notes that our attack generation relies on a differentiable pipeline (using Kornia), a point we acknowledge in our limitations. This is a common requirement for gradient-based adversarial training. To apply OMAT to an existing detector, it would need to be fine-tuned within such a framework. Crucially, this is a **one-time, training-stage consideration.** The final, OMAT-trained detector is a standard classifier with **no special dependencies at inference time**, making it broadly deployable."}, {"review_id": "nBgRbn5l2z", "reviewer": "Reviewer_HLVt", "summary": "This paper analyzes the impact of noise in generative models on the performance of detection systems and proposes a method to generate on-manifold adversarial examples through targeted noise attacks on generative models. These adversarial examples are incorporated into the training of detectors to enhance their detection performance.\n\n The method involves a detailed analysis of the generation mechanism of generative models and designs a detection strategy accordingly, demonstrating strong originality. A new dataset is also introduced, reflecting the significant amount of work conducted. Overall, the writing is fluent and professional, with well-presented and sufficient figures and tables.", "questions": "1. The method is designed based on the generation principles of diffusion models. However, why does the performance on BigGAN also improve significantly after incorporating the CLIP encoder?", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n\n1. Proposes the On-Manifold Adversarial Training method based on the working principle of diffusion models, optimizing noise for improved generalization in detection, and achieving excellent generalization performance.\n\n2. Introduces the GenImage++ test dataset, which includes images generated by advanced generators (such as Flux.1 and Stable Diffusion 3) under extended text prompts and diverse styles.\n\n\nWeaknesses\n\n1. The experiments mainly focus on diffusion models. It would be beneficial to include experiments on additional datasets, as the current experimental coverage is somewhat limited.", "was_revised": true, "final_justification": "The responses have addressed most of my concerns. The supplementary experimental results substantially validate the study's broader relevance. I recommend adding the suggested experiments and discussion from all reviewers in the final paper.", "rebuttal": "We sincerely thank the reviewer for their positive and insightful feedback. We are encouraged that they appreciated our core method and the introduction of the GenImage++ benchmark. We will address their excellent questions below.\n\n#### **1. On Generalization to GANs (e.g., BigGAN)**\n\nThe reviewer asks an excellent and crucial question: why does our method, trained by attacking a *diffusion model*, improve performance so dramatically on a completely different architecture like a *GAN*?\n\nThis is the central validation of our core hypothesis. We argue that standard detectors fail to generalize because they learn superficial \"shortcuts.\" Our work identifies a key shortcut: **latent prior bias**, where detectors overfit to artifacts from the `z_T` prior of the *training diffusion model*.\n\nBy using On-Manifold Adversarial Training (OMAT), we penalize the detector for relying on this diffusion-specific shortcut. This forces the model to abandon these easy features and instead learn the more subtle but **fundamental and shared artifacts of AI synthesis (`f_gen`)**.\n\nThe hypothesis that such universal artifacts exist is a cornerstone of modern AIGC forensics, based on the understanding that nearly all high-resolution generative models, regardless of their paradigm (GAN, VAE, Diffusion), rely on a similar underlying architectural toolkit. **Specifically, the extensive use of hierarchical upsampling is a primary source of shared, detectable fingerprints.**\n\n*   **Upsampling Artifacts:** Most generators must upsample low-resolution feature maps to a high-resolution image. Common layers like transposed convolutions are well-known to produce characteristic \"checkerboard artifacts,\" which are a detectable, cross-model signature of the upsampling process [1].\n*   **Frequency Domain Biases:** Beyond specific patterns, the hierarchical nature of U-Nets (used in diffusion models) and stacked GANs creates distinct, non-uniform effects in the frequency domain of the output images [2, 3]. These spectral biases are a structural consequence of the architecture, not the high-level generative paradigm.\n\nBy learning to recognize these more universal, architectural fingerprints, our OMAT-trained detector becomes broadly generalizable. Its strong performance on BigGAN is not an accident; it is direct evidence that OMAT successfully shifted the model's focus from a narrow, generator-specific shortcut (`z_T` bias) to the fundamental, shared traces of neural image synthesis.\n\n#### **2. On Broadening Experimental Scope**\n\nWe thank the reviewer for this valuable suggestion. To further validate the cross-architecture generalization discussed above and address the concern about limited experimental scope, we have evaluated our best OMAT-trained detector (trained only on SDv1.4) on a wide variety of GAN-based datasets from the public **AIGCDetectBenchmark**. The results are presented below.\n\n**Table: Generalization performance (Accuracy %) of our OMAT-trained detector on various GAN-based datasets from the AIGCDetectBenchmark.**\n\n| Generator               | Accuracy (%) |\n| :---------------------- | :----------: |\n| StyleGAN                |    79.79     |\n| StyleGAN2               |    74.12     |\n| CycleGAN                |    93.38     |\n| StarGAN                 |    96.47     |\n| GauGAN                  |    91.28     |\n| BigGAN                  |    88.75     |\n| **Average GAN Performance** |  **87.30**   |\n\nThese strong results confirm that our method generalizes effectively far beyond diffusion models. Achieving over 87% average accuracy across six different GAN architectures, despite being trained only on SDv1.4, provides powerful evidence for the broad applicability and significance of our approach. We will add these results to the final manuscript to strengthen our experimental validation.\n\n[1] Odena, A., et al. \"Deconvolution and Checkerboard Artifacts.\" *Distill* (2016).\n\n[2] Falck, F., et al. \"A multi-resolution framework for U-Nets with applications to hierarchical VAEs.\" *NeurIPS* (2022).\n\n[3] Falck, F., et al. \"A Fourier Space Perspective on Diffusion Models.\" *arXiv* (2025)."}, {"review_id": "NtmO9PJ1UO", "reviewer": "Reviewer_pPqb", "summary": "This paper tackles a significant challenge in AI-generated content (AIGC) detection: the inability of detectors to generalize across unseen generative models. The authors identify latent prior bias as a critical factor, whereby detectors tend to learn shortcuts specific to certain generative models rather than features that are generalizable. To address this, the paper introduces On-Manifold Adversarial Training (OMAT), a technique that generates adversarial examples by perturbing the latent space of diffusion models. These perturbations remain on the generative manifold, unlike pixel-space attacks, which create off-manifold noise. Additionally, the paper presents GenImage++, a new benchmark designed to evaluate AIGC detectors against advanced generative models, including Flux.1 and Stable Diffusion 3 (SD3). Experiments show that detectors trained with adversarial examples achieve state-of-the-art generalization across various benchmarks.", "questions": "See weaknesses.", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "### Strengths\n1. Novel Contribution: The paper offers a novel perspective by exposing latent prior bias in AIGC detectors and proposing OMAT, which directly targets latent noise vectors. This approach improves generalization across unseen generative models without relying on large datasets or complex reconstruction pipelines.\n2. Comprehensive Evaluation: The experiments are thorough, comparing the proposed method with various baseline detectors and adversarial training techniques. The introduction of the GenImage++ dataset is a valuable contribution, highlighting the capabilities of contemporary generative models.\n3. Practical Impact: The proposed method significantly enhances detector generalization, marking a meaningful advancement in the development of robust forensic tools capable of detecting AI-generated content across diverse models.\n4. Strong Results: The paper demonstrates that detectors trained with OMAT show substantial improvements in cross-generator performance, particularly when evaluated against advanced generators. These findings underscore the importance of addressing latent prior bias to achieve more robust and generalized AIGC detection.\n\n### Weaknesses\n1. Computational Cost: The on-manifold latent optimization attack requires substantial computational resources, particularly in terms of VRAM usage. While this is understandable given the complexity of the task, it may limit the scalability of the method for large-scale applications or for researchers without access to high-end hardware.\n2. Lack of Detailed Error Analysis: Although the experiments are extensive, a more in-depth error analysis, especially regarding the failure cases of detectors post-adversarial training, would offer additional insight into the robustness of the proposed methods. Understanding these edge cases could help refine the approach.\n3. Limited Comparison with Non-Diffusion Models: The paper primarily focuses on diffusion models like Stable Diffusion and Flux but does not compare performance with a broader range of generative models, such as GAN-based generators or VAEs. Including such models would provide a more comprehensive evaluation of the approach.\n4. Dependence on Differentiable Preprocessing: The need for differentiable preprocessing limits the method's applicability to detectors using non-differentiable preprocessing pipelines. While the paper acknowledges this limitation, it may still hinder broader adoption of the method.\n5. Benchmark Accessibility: Although the GenImage++ dataset is presented as a key contribution, it is unclear whether it will be publicly accessible. Ensuring easy access to this dataset would benefit the community by enabling others to replicate experiments and further test the effectiveness of the proposed methods.\n6. I recommend that the authors also evaluate AEROBLADE[1] and LaRE^2[2] on the benchmark.\n\n[1] AEROBLADE: Training-Free Detection of Latent Diffusion Images Using Autoencoder Reconstruction Error\n\n[2] LaRE^2: Latent Reconstruction Error Based Method for Diffusion-Generated Image Detection", "was_revised": true, "final_justification": "The rebuttal has addressed most of my concerns with clarifications or additional experiments. The authors should incorporate all the information in the rebuttal into the final version.", "rebuttal": "We sincerely thank the reviewer for their detailed feedback. We are encouraged that they recognized the novelty of our contribution, the strength of our results, and the practical impact of our work. Their critiques, particularly regarding the perceived limited evaluation, have prompted us to conduct new experiments that we believe decisively address these concerns and demonstrate the significance of our findings.\n\n#### **1. On Evaluation Scope & Comparison with Non-Diffusion Models (GANs)**\n\nThe reviewer raised a critical point about the limited comparison with non-diffusion models. We agree a broader evaluation is essential and, motivated by this feedback, have tested our OMAT-trained detector (trained only on SDv1.4) on a wide array of **GAN-based generators** from the public AIGCDetectBenchmark.\n\n**Table: Generalization performance (Acc %) of our OMAT-trained detector on various GAN-based datasets.**\n| Generator               | Accuracy (%) |\n| :---------------------- | :----------: |\n| StyleGAN                |    79.79     |\n| StyleGAN2               |    74.12     |\n| CycleGAN                |    93.38     |\n| StarGAN                 |    96.47     |\n| GauGAN                  |    91.28     |\n| BigGAN                  |    88.75     |\n| **Average GAN Performance** |  **87.30**   |\n\nThese strong results, achieving **over 87% average accuracy across six different GAN architectures**, provide powerful evidence that our method is not limited to diffusion models. By forcing the detector to ignore the diffusion-specific `z_T` shortcut, OMAT compels it to learn fundamental artifacts (`f_gen`) of neural synthesis (e.g., from upsampling layers) that are common across different generative families. This confirms the broad applicability and significance of our approach. We will add these extensive new results to the final manuscript.\n\n#### **2. On Comparison with New Baselines & Benchmark Accessibility**\n\nThank you for these excellent suggestions. We have now evaluated our model against **AEROBLADE** on our GenImage++ benchmark, and the results (included in our full SOTA comparison table, see response to Reviewer jB2U) confirm our method's superior performance. We also attempted to evaluate **LaRE²**, but the authors have unfortunately removed the official pre-trained weights, making a direct and fair comparison infeasible within the rebuttal period. We will include AEROBLADE and acknowledge LaRE² in the final manuscript.\n\nFurthermore, our new GenImage++ benchmark—including all generated images, prompts, and generation code—is already prepared and will be made publicly accessible upon publication to facilitate immediate community research and replication.\n\n#### **3. On Computational Cost & Methodological Limitations**\n\nWe agree with the reviewer on these limitations and discuss them in the paper. We offer the following clarifications:\n*   **Computational Cost:** The high cost is a **one-time investment for training data generation.** Crucially, our final OMAT-trained detector is a standard classifier with **zero inference overhead**, unlike many reconstruction-based SOTA methods (like AEROBLADE/DRCT/FakeInversion), making it highly practical for deployment.\n*   **Differentiable Preprocessing:** This is a requirement for our *attack generation*, not for the final detector. To apply OMAT to an existing model, it must be fine-tuned in a differentiable framework. The resulting robust model, however, has no special dependencies at inference time.\n\n#### **4. On Error Analysis**\n\nThis is a valuable suggestion. A detailed error analysis is an important next step for understanding the remaining limitations of our method. Given the text-only format of the rebuttal, a visual analysis is not possible, but we can offer a high-level perspective.\n\nWhile our method significantly boosts generalization, detecting \"in-the-wild\" images, such as those found on social media, remains a formidable open challenge. These images introduce factors that our current training paradigm does not explicitly model, such as:\n*   **Extreme diversity of unseen generators and post-processing tools.** Images on platforms like Discord or Civitai are often created with unknown base models, custom fine-tuning (e.g., LoRA adapters), and complex post-processing, creating a vast and unpredictable distribution of generative artifacts.\n*   **Heavy and unpredictable compression artifacts.** Social media platforms apply unknown and often aggressive compression algorithms, which can destroy or alter the subtle forensic traces our detector has learned to identify.\n\nWe hypothesize that our OMAT-trained detector, having learned more fundamental artifacts, is a better starting point for tackling these challenges than standard detectors. However, a full analysis of its failure cases in these \"in-the-wild\" scenarios is a critical and exciting direction for future research. We will add this important discussion to the limitations section of our final manuscript."}, {"review_id": "f1dCiJXInA", "reviewer": "Reviewer_kDqu", "summary": "This paper identifies latent prior bias in AIGC detectors by proposing an on-manifold adversarial attack that perturbs initial noise in diffusion models to bypass detection, revealing vulnerabilities in existing forensic methods. The authors introduce OMAT, an adversarial training framework that enhances detector robustness by learning from these on-manifold adversarial examples, achieving state-of-the-art generalization across diverse generators.", "questions": "See weakness", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength\n\n- The writing is good and easy to follow.\n    \n- The proposed Latent Prior Bias Attack is novel and essential.\n    \n- The method is simple but effective. The experiment is extensive and the evaluation results seems good.\n\nWeakness\n\n- As a data augmentation approach, demonstrating OMAT’s performance on various baselines (rather than only ResNet or CLIP+Linear) would better illustrate its effectiveness.\n    \n- What specific benefits does the proposed method offer in terms of robustness enhancement? It would be better to explicitly compare against alternative methods, like using images generated with various random seeds.\n    \n- The accuracy on real-world images appears unexpectedly low (Table 2). Could the authors provide more analysis on potential factors contributing to this performance limitation?\n    \n- Table 3 lacks a comparison with the original CLIP+LoRA.", "was_revised": true, "final_justification": "The authors' rebuttal has addressed my partial concerns (Q2 & Q4).\n\nI still have slight concerns about Q1 and Q3, but I believe these will not affect the main contribution.\n\nBased on this, I will maintain my original positive score.", "rebuttal": "We sincerely thank the reviewer for their positive feedback on our work's novelty, simplicity, and effectiveness. Their questions are very insightful and will help us improve the clarity and impact of our paper.\n\n#### **1. On OMAT's Application: A Principled, Data-Centric Evaluation**\n\nThe reviewer raises an excellent point about testing OMAT on more baselines. This was a deliberate and central choice in our experimental design. Our goal was not just to show that OMAT improves performance, but to **isolate and prove the existence of latent prior bias from a purely data-centric perspective.**\n\nTo achieve this, we intentionally selected two standard, well-understood backbones (ResNet50 and CLIP+Linear) *precisely because they are generic*. Highly specialized, \"well-designed\" forensic detectors often incorporate strong architectural priors or handcrafted features (e.g., frequency analysis) that could introduce confounding biases. Testing on such models would make it difficult to disentangle the effects of OMAT from the effects of the specialized architecture.\n\nBy demonstrating that OMAT yields substantial and consistent gains on two architecturally distinct *general-purpose* vision models, we provide clean evidence that:\n1.  Latent prior bias is a fundamental, model-agnostic vulnerability that arises from the training data itself.\n2.  OMAT is its effective, data-driven solution, not a trick that only works for a specific architecture.\n\nWe believe this principled approach provides a clearer and more foundational understanding of the problem. We will clarify this scientific rationale for our choice of baselines in the final manuscript.\n\n#### **2. Robustness Enhancement vs. Simple Seed Variation**\n\nThis is an excellent question that gets to the heart of why our adversarial approach is necessary. The reviewer asks if simply training on images from more random seeds would suffice. Our experiments show that it would not.\n\nIn our Appendix (B.2, Analysis of Optimized Latent Noise Vectors), we conducted a focused experiment attacking an image of a \"cat\" with 200 different initial random seeds (`z_rand`). Before optimization, **the baseline detector correctly identified the images from all 200 un-optimized seeds as fake.** Only after our targeted, adversarial optimization could these seeds produce images that fooled the detector.\n\nThis proves that simply increasing the diversity of random seeds in the training data would not expose the latent prior bias. The detector is already robust to standard seed variations. It is only vulnerable to the specific, targeted perturbations found via our adversarial search. Therefore, the adversarial nature of OMAT is essential for mitigating this specific shortcut and enhancing true robustness.\n\n#### **3. On Performance with Real-World Images (Table 2)**\n\nThe reviewer points out the 66.05% accuracy on the Chameleon dataset, which is a very insightful observation. This performance, while seemingly modest, is actually **state of the art** for this challenging \"in-the-wild\" benchmark under the specified training conditions.\n\nThe difficulty arises from factors that are unconstrained in real-world scenarios:\n*   **Unknown & Customized Generators:** Images on platforms like Discord or Civitai are often created with unknown base models, custom fine-tuning (e.g., LoRA adapters), and complex prompt engineering, creating a vast and diverse set of sources.\n*   **Social Media Compression:** Images are subjected to various unknown and often aggressive compression algorithms, which can destroy or alter forensic traces.\n\nAddressing this \"in-the-wild\" problem is a major open challenge for the entire AIGC forensics field. Our 66.05% accuracy should be viewed not as a limitation, but as a significant step forward, outperforming all other baselines on this difficult task. We will add this context to the paper to clarify the significance of this result.\n\n#### **4. On Including the Baseline in Table 3**\n\nThank you for pointing out this important omission. The reviewer is correct that Table 3 should include the performance of the original baseline model from which our OMAT models are fine-tuned. For our CLIP+LoRA experiments, this starting point is the **CLIP+Linear detector**.\n\nWe have now evaluated this baseline on our challenging GenImage++ benchmark. The updated table below provides a direct, side-by-side comparison on each subset, clearly demonstrating the substantial and consistent gains achieved by OMAT across different LoRA ranks.\n\n**Table: Detailed performance comparison on the GenImage++ benchmark subsets.**\n| GenImage++ Subset  | CLIP+Linear (Baseline) Acc % | OMAT LoRA R4 Acc % | OMAT LoRA R8 Acc % | OMAT LoRA R16 Acc % |\n| :----------------- | :--------------------------: | :----------------: | :----------------: | :-----------------: |\n| Flux               |            85.62             |       96.53        |       97.48        |        97.93        |\n| Flux Multi-style   |            87.67             |       92.55        |       85.88        |        89.48        |\n| Flux Photo         |            80.40             |       97.60        |       95.19        |        99.44        |\n| Flux Realistic     |            84.10             |       97.67        |       96.45        |        96.25        |\n| SD1.5 Multi-style  |            97.01             |       100.00       |       100.00       |       100.00        |\n| SDXL Multi-style   |            83.51             |       99.17        |       94.53        |        98.30        |\n| SD3                |            85.97             |       98.27        |       98.02        |        98.56        |\n| SD3 Photo          |            83.32             |       90.38        |       95.66        |        91.50        |\n| SD3 Realistic      |            84.15             |       98.82        |       96.98        |        97.28        |\n| **Average**        |          **85.75**           |     **96.78**      |     **95.58**      |      **96.53**      |"}]

Author rebuttal:

Meta-review: To address the problem of latent prior bias in detectors for generalizable AIGC image detection, this work presents On-Manifold Adversarial Training (OMAT), which optimizes the initial latent noise of diffusion models under fixed conditioning so as to generate on-manifold adversarial examples that remain on the generator’s output manifold.
Most reviewers are satisfied with responses from the authors in addressing their concerns.

In particular, after the rebuttal periods, we have the following conclusions:
Reviewer evQu: entirely satisfied with the responses from the authors.
Reviewer HLVt : most concerns were addressed.
Reviewer pPqb: most concerns were addressed.
Reviewer: kDqu: partial concerns were addressed but the remaining concerns did not affect the main contribution of this submission.

However, Reviewer  jB2U stills raised some concerns.
Based on the authors' rebuttals, the AC agrees with authors' points as follows:
On the "Unrealistic Threat Model" vs. A Diagnostic Tool; On "Hard Negatives" vs. Targeted Bias Mitigation
; and On "Incremental Novelty" vs. A Foundational Contribution.

Based on the above overall concerns, the AC suggests to accept this work.
Decision: Accept (poster)