Denoising Trajectory Biases for Zero-Shot AI-Generated Image Detection
Authors: Yachao Liang
Min Yu
Gang Li
Jianguo Jiang
Fuqiang Du
Li Jingyuan
Lanchi Xie
Zhen Xu
Weiqing Huang
Venue: NeurIPS 2025 poster ()
Keywords: AI-generated image detection
diffusion model
ddim
gan
Primary area: applications
TL;DR: A novel zero-shot generated image detection

Abstract: The rapid advancement of generative models has led to the widespread emergence of highly realistic synthetic images, making the detection of AI-generated content increasingly critical. In particular, diffusion models have recently achieved unprecedented levels of visual fidelity, further raising concerns. While most existing approaches rely on supervised learning, zero-shot detection methods have attracted growing interest due to their ability to bypass data collection and maintenance. Nevertheless, the performance of current zero-shot methods remains limited. In this paper, we introduce a novel zero-shot AI-generated image detection method. Unlike previous works that primarily focus on identifying artifacts in the final generated images, our work explores features within the image generation process that can be leveraged for detection. Specifically, we simulate the image sampling process via diffusion-based inversion and observe that the denoising outputs of generated images converge to the target image more rapidly than those of real images.  Inspired by this observation, we compute the similarity between the original image and the outputs along the denoising trajectory, which is then used as an indicator of image authenticity.Since our method requires no training on any generated images, it avoids overfitting to specific generative models or dataset biases. Experiments across a wide range of generators demonstrate that our method achieves significant improvements over state-of-the-art supervised and zero-shot counterparts.

Denoising Trajectory Biases for Zero-Shot AI-Generated Image Detection
Yachao Liang!? Min Yu Gang Li
Jianguo Jiang! Fugiang Du
Jingyuan Li Lanchi Xie Zhen Xu Weiging Huang! 1.2
IIntitute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences 3 Deakin University *Beijing Technology and Business University Institute of Forensic Science, Ministry of Public Security {liangyachao, yumin]@iie ac cn
Abstract
The rapid advancement of generative models has led to the widespread emergence highly realistic synthetic images, making the detection Al-generated content increasingly critical. In particular, diffusion models have recently achieved un- precedented levels of visual fidelity, further raising concerns. While most existing approaches rely supervised learning, zero-shot detection methods have attracted growing interest due to their ability to bypass data collection and maintenance. Nevertheless, the performance of current zero-shot methods remains limited. In this paper, we introduce a novel zero-shot Al-generated image detection method. Unlike previous works that primarily focus identifying artifacts in the final generated images, our work explores features within the image generation process that can be leveraged for detection. Specifically, we simulate the image sampling process via diffusion-basse inversion and observe that the denoising outputs of gen- erated images converge to the target image more rapidly than those of real images. Inspired by this observation, we compute the similarity between the original image and the outputs along the denoising trajectory, which then used as an indicator of image authenticity. Since our method requires no training on any generated images, it avoids overfitting specific generative models or dataset biases. Experiments across wide range of generators demonstrate that our method achieves significant improvements over tfte-of-thheart supervised and zero-shot counterparts. Code is available here
Introduction
Recent years, we have witnessed spurt of development in the field of Artificial Intelligence Generated Content (AIGC). With the advent of cutting-edge generative models, such as StyleGAN (28) and the quality synthetic images has been significantly improved. With tools like Stable
Diffusion 24
Diffusion 50 and ControlNet (67). people quickly create artistic images conforming to their ideas. Today, we can already see a large number of generated images on the Internet, which are hard to distinguishable from real images for humans [42]. While image generation technology can increase our enjoyment of life, the proliferation of fake images with misleading information also bring huge security risks.
In response to this, different detection methods have been explored 18 63
8
23
Researchers
attempt to address this from different perspectives, e.g., frequency anomalies 18
44
60
32
and
"Corresponding authors
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Although previous methods achieve promising detection results, significant issue that the performance of detectors degrades considerably when they encounter images generated by unseen generators. A primary reason is that images generated by different generative models exhibit distinet forgery characteristies, and detectors tend to overfitting to the categories of fake images used in training.
semantic differences 66 36 25],
x0
Score direction
Denoising trajectory
8o (x2)
Sampling trajectory
X1
: Ro 1x)
Xt-1
(x,)
Xx
An illustration of the denoising trajectory. In the sampling process of PF-ODE based diffusion model, the noisy image is iteratively updated by moving a certain distance toward the denoising output 2o (t) predicted by neural network at each step, eventually yielding noise-free image. this process, the intermediate denoised states 2, form the sampling trajectory, while the corresponding denoising outputs (t) constitute the denoising trajectory.
Figure 1:
Image generation is progressive refinement process. This is especially evident in recent diffusion models [24 56 57], where the sampling process typically involves hundreds or even thousands of
steps. For another branch of generative models, GANs [2 3 28), previous studies (65 19 17
have also suggested that the evolution generator parameters during training can be viewed as diffusion-like process. Most existing detectors [4
34 68] focus identifying artifact-based features in final generated images, while few have explored the informative signals embedded in the image generation process itself. In this work, attempt to uncover diseriminative information between real and generated images by analyzing their generation processes. Specifically, we simulate the generation process using DDIM inversion [55] and construct the denoising trajectories of input images, as shown in fig. [ We observe that, compared to real images, the denoising trajectories of generated images exhibit earlier mode change, with denoising outputs converging more rapidly the final image. As result, the similarity between the denoising outs and the final image can serve as an effective indicator for distinguishing between real and generated images.
Inspired by the above findings, we propose a novel zero-shot method for detecting generated images. Concretely, we perform DDIM inversion (55) on the input image to simulate the sampling process and collect the denoising outputs throughout the process. Then we use pre-trained CLIP [46] model to extract semantic features and compute the feature similarity between the original image and each image along the denoising trajectory, summing the results to obtain a final similarity score. Additionally, further incorporate embeddings from intermediate layers of CLIP to capture fine-grained features.
To validate the effectiveness of our method, we conducted extensive experiments multiple datasets of generated images. The evaluation covered a wide range of generative models, including some the most recent ones. Experimental results demonstrate that our approach exhibits strong generalization ability, Our contributions can be summarized as follows:
We demonstrate that the denoising outputs of generated images converge faster than those of real images.
We propose novel zero-shot method for detecting generated images based the similarity between images along the denoising trajectory and the input image.
Through extensive experiments, our method presents superior generalization ability. Notably, it exhibits average performance improvements of 8. % in accuracy and 9.8% in average precision over the state-of-the-art, evaluated across 21 generators.

---

2 Preliminaries
2.1 Denoising Trajectory of ODE-based Diffusion Model
gradually add noise with perturbing kernel (r))) = (a1;; varzoo o² (1)T), where Zo Pdata. E [0, T] and ate o (t) are noise schedules. Eventually, pr will follow standard Gaussian distribution. Song al. [58] presents generalized framework this process with stochastic differential equation (SDE), and further propose the corresponding probability flow ordinary differential equation (PF-ODE), which shares the same marginal distributions as the SDE. Images can be deterministically generated by constructing the reverse-time PF-ODE. Particularly, DDIM 55
Given a data distribution Pdota- the forward process of the diffusion model [54 56 24
is a special case of the PF-ODE,
with the following form:
2t-1 = (a 06-16
and
f0(x);0,) Tt - oxea(2)))
(2)
Vai
where (oy; 0z) is an estimate of the original sample xo and co (#t. t) denotes the noise predicted by the neural network. The denoising trajectory can be obtained by taking denoising outputs, (0 oz), at each step of this sampling process. For existing images, we can use the DDIM inversion to obtain the approximate sampling process and denoising outputs. we provide some examples of denoising outputs in appendix A.3
2.2 Generated Image Detection
High-Freq High-Frreuuncy Based Detection. Previous works point out that Al-generated images show anomaly spectral distribution. Concretely, generated images exhibit different high-freqqency mode [3],
which is believed to be caused by the upsampling operation in the neural network. Inspired by
this insight, some works detect generated images by extracting low-level information [60] 40 10
Typically, researchers extract nigh-frequency components of images through wavelet transform 32
noise pattern extraction [34], or resampling residual feature analysis [60. [10) reveals the high-
frequency differences between real and generated images in unsupervised manner.
Semantic Based Detection. Another route line explores semantic features for generated image detection. Researchers utilize pre-trained models to extract features in advance or finetune them, thereby guiding detectors to focus more on semantic features. [62] show that a naive Resnet50 trained on ProGAN-generatee [27] images can generalize to other GAN-generated images. In addition, 43 proposed to map images into an universal space by the image encoder of CLIP 46) to boost the generalization ability of detectors. (35) further suggests incorporate the text encoder of CLIP to introduce language information. Recently, SIDA [25] performs explainable detection with the aid of rich visual and textual knowledge of large multimodal model.
3 Method
In this section, we first analyze the differences in the denoising trajectories between real and generated images and conduct preliminary experiments to validate our findings. We then introduce our zero-shot method for detecting generated images, which is based on the insights derived from the preceding analysis.
3.1 Denoising Trajectory Analysis
Previous studies have found that the generation process of diffusion models can be regarded as frequency autoregressive process 44 I2 16]. Since random noise has equal energy across all frequencies, the forward noising process progressively destroys image content from high low frequencies. Conversely, the reverse denoising process, i.e., the generation process, gradually restores image information from low to high frequencies. The above description refers to the changes images along the sampling trajectory. Similarly, the images along the denoising trajectory, also conform to seqquency-autorgrres generation process that progresses from low high frequencies. Below, we provide simple analysis following the method in [12).
3

---

CLIP
CLIP
CLIP
CLIP
CLIP
Xg
8
82
8
Pixel
Space
Similarity
E
D
D
D
D
Embedding
Latent
VAE Encoder
Space
Zp
2,
2
D
VAE Decoder
DDIM Inversion
Figure 2: Overview of the proposed method. Given input image, employ DDIM inversion to approximate its sampling process and obtain the denoising outputs at each step. We then use CLIP to extract features from both the original image and each image along the denoising trajectory, and compute their cosine similarities, which serves as the criteria for detecting generated images.
Consider Gaussian forward diffusion process:
It at To + OEE, E0,
is standard Gaussian noise. Let Rfx[(f) denote the radially averaged power spectral density (RAPSD) of image x at spatial frequency f. For white Gaussian noise, R[e](f) 1 holds for all We define that frequency component is detectable if its signal power exceeds given signal-to-noise ratio (SNR) threshold т
Because the Fourier transform is a linear operator and the power spectrum scales quadratically with amplitude, we have
R[a,za](f) = af (f), R[axe((f) of R[s](f) = =
(4)
frequency component is considered detectable if
of of
R[arxo)(f)) 7 R(ore(())
(5)
As the noise level decreases during the reverse diffusion process, the ratio 0r/a, decreases. Conse- quently, fm)x(t), the maximal detectable frequency, increases monotonically, implying that higher frequencies become progressively detectable. Since the model does not hallucinate information that completely obscured by noise, the spectral content of its denoised outputs will primarily consist of the detectable frequencies that satisfy the above inequality. Therefore, the images along the denoising trajectory will gradually transition from low-frequency components to details, which is consistent with the actual observations. In summary, the images in the denoising trajectory, do (are; o.), follow a progressive refinement process from low high frequencies, as shown in fig.
Previous works suggest that there are discrepancies between the distribution learned by diffusion models and the true distribution of real images [64] 338 [3]. It inspires us to make reasonable speculate that the diffusion model can predict generated images more accurately, which means the denoising trajectories of generated images will converge more quickly according to above analysis. To verify this conjecture, we inverse the sampling processes of some real and generated images with DDIM inversion [55], and collect the denoising outputs during these processes. Next, we measure their spectral similarity with the original image. Specifically, we compute the power spectral density of the images at different timesteps along the denoising trajectory and calculate their differences from the original image each frequency. Since the effective frequency range of these images progresses from low high frequencies, apply corresponding frequency masks when computing

---

the differences. As shown on the right side of the fig. the differences for real images are larger than those for generated images. It indicates that the denoising outputs generated images achieve faster convergence toward the target images. As result, compared to real images, generated images and the intermediate images along the denoising trajectories will exhibit higher similarity.
Pilee
30
Roeer seettrr dendtry
10
40
Tirateo
Figure 3: (a) Frequency transition of images along the denoising trajectory (reverse process). (b) Spectral differences between real/fake images and the images along their denoising trajectories: We randomly select 500 real images from ILSVRC [51] and fake images generated by Stable Diffusion v1.5 [50], then calculate the Power Spectral Density (PSD) of each image the denoising trajectory and their differences from the original image at each frequency.
3.2 Generated Image Detection
Using the above biases, we propose a novel zero-shot Al-generated image detection method, which employs the similarity between the intermediate images along the denoising trajectory and the original image as a criterion differentiate real and generated images. As shown in fig, 2 we first apply DDIM inversion [55] to the input image and collect the denoising outputs at each step. Note that we employ the commonly used latent diffusion model, therefore, we need utilize the VAE encoder to yield inputs and the VAE decoder to the outputs. To calculate the similarity between different images, we extract features from images using CL.PP [46), which demonstrates superior generalization ability large corpus of image-text pairs. We then calculate the cosine similarity
owing to its pretraining between the features of each denoised image and those of the original image, and aggregate these similarities to obtain the final semantic similarity score.
5(x)
sim (embbmb(a), emb():))
(6)
where sim(..> -) denotes cosine similarity, and we use the class embeddings as features of images.
Incorporating features of intermediate layers. An in- tuitional way to extract features of an image using CLIP to take the output from its final layer as the represen- tation of the image in 43 35]. However, the features extracted by different layers of CLIP exist non-negligible differences. Specifically, shallow layers of CLIP focus on low-level features such as textures, while deep layers concepts of the entire image [20) [1 26]. Directly using the em- beddings from the final layer will overlook iineggraieed content, which is important for our detection task since the denoising outputs the later stages of sampling differ from the original image only in fine details. Therefore, to capture both the global and fine-graid tineggriied features of the im- age, we use the features extracted from each layer of CLIP for similarity computation. We provide a more intuitive demonstration of this in fig. 4 In order to identify the sensitivity of each layer of CLIP to fine-grained changes, we apply blurring to images and compute the embedding similarity between the original and blurred images at each layer.
Similarit
extract high-level semantic representations
25
Layer
Figure 4: Sensitivity of each layer of
CLIP fine- graingr changes.
5

---

Table 1: Cross-architecturc generalization. We report the Acc (%) and AP (%) on ForenSynths. The supervise baselines are trained on ProGAN, except for SIDA trained on their custom dataset. We adopt either the officially released pre-trained models or reproduce the results by training according the provided code repositories. Zero-shot methods are displayed with the gray background.
Method
PooGAN
GauGAN
RigGAN
StarGAN
CycleGAN
StyleGAN
StyleGAN2
Ace
AP
Acc
AP
Acc
AP
Acc
AP
Acc
AP
Acc
AP
Acc
AP
Asc
AP
85.5
99.9
96.1
99.8
98.4
FeegNet 59
99.6
100.
93.4
98.6
90.5
96.0
K5.7
99.8
95.8
99.6
90.2
99.7
87.9
99.5
91.9
99.0
FreDect 18
100.
80.5
82.8
82.0
93.6
94.6
99.5
78.8
84.8
78.0
89.0
66.2
82.5
82.8
90.3
CNNSpor [2
100.
100.
81.4
90.8
71.1
86.0
94.6
99.0
87.6
94.9
87.6
99.8
85.4
99.4
86.8
95.7
UnivFD A3
100.
100.
99.5
100.
95.1
99.3
95.7
99.4
98.1
99.9
98.5
100.
74.2
98.4
94.4
99.6
SIDA' 25
71.3
77.3
70.4
69.7
74.8
82.9
66.3
95.9
68.1
64.1
64.0
70.0
51
59.3
66.6
74.2
AEROBLADE 48
47.4
50.3
44.8
42.6
50.1
47.4
51.1
47.1
42.2
41.0
46.9
43.6
37.4
38.2
45.7
44.3
MIBD 77
90.3
97.4
87.9
97.9
77.6
86.8
50.6
55.3
73.4
90.5
70.5
76.5
64.2
72.8
73.5
82.5
Zerof aake 53
48.0
44.9
58.6
60.6
50.3
53.3
45.8
39.9
55.6
46.4
49.2
52.1
45.5
46.4
50.4
49.1
97.5
93.5
97.7
89.9
As we have previously analyzed, the denoising outputs of generated images converge more quickly. We distinguish generated images from real counterparts based on the similarity of the semantic representations between the original image and the images along the denoising trajectory, with real images exhibiting higher similarity scores. Since our method does for training, avoids the overfitting problem and theoretically has better generalization ability.
any type of fake images
4 Experiments
4.1 Experiment Setup
Baselines. We compare our method with three types of detector, including high-frequency based methods, semantic feature based methods, and zero-shot detection methods. Specifically, for the high-frequency based methods, FreqNet [59], FreDect [8] and NPR [60] extract high-frrqueecy features of images using Fourier transform, discrete cosine transform, and resampling, respectively.
The semantic-based methods include CNNSpot [62], UnivFD 43] and SIDA (25). which respectively use ResNet, CLIP, and Large Multimodal Model [3 as backbones to extract semantic features and are fine-tuned for task of generated image detection. Finally, we also compare our method with three zero-shot detection methods. AEROBLADE [48] identifies fake images based on the differences between the original image and the one reconstructed by the VAE. ZeroFake (53] achieves generated image detection based on the similarity between original image and the image edited using diffusion model. MIBD 7 approximates the curvature and gradient of the probability manifold to enable zero-shot detection. Please see appendix A. for more details.
Datasets. To verify the effectiveness of our method, we benchmark on a large number of fake images generated by different types of generators involving GANs and diffusion models. ForenSynths [2]
contains images generated by various GANs, e.g., ProGAN 27 and StyleGAN (28). The real images
are collected from LSUN [66), ImageNet [52] COCO 33 and CelebA (37 GenImage 77) include
early text-to-image diffusion datasets, such as Stable Diffusion V1.4
500 and Glide [11, and the
real images are sampled from ImageNet [52] New Generator: Considering the rapid development
of generative models, we also test on images generated by several cutting-egge generative models. Specifically, take the test set of COCO [33] as the real image dataset, then collect images generated by FLUX [30], Stable Diffusion XL (SDXL) [45), and Stable Diffuusin V3 (SD3) [I5) with corresponding prompts of real images. We further collected fake images generated by DALLE3 (5), Firefly, and Midjourney-v5 (MJv5) [ from models used.
See appendix A.2 for the full list of generative
Implementation Details. We perform a 50-step DDIM inversion with Stable Diffusion v1.5, before which we crop images to the size of 512x512. We use CLIP ViT-L/14 to extract features. Our experiments are implemented with PyTorch on NVIDIA A100 GPU. We set the detection threshold as 0.75.

---

Table 2: Cross Pross-paradigm generalization in terms of Acc performance.
Method
GenImuge
New Generator
AVG
SDL.4
SD1.5
ADM
DAILE2
MI
Glide
VQDM
Wakknng
DALLES
Firell
Mls5
SDXL
FLUUX
5113
NPR [0]
78.6
78.9
69.7
64.9
77.8
75.3
78.1
76.1
79.0
73.6
50.0
80.0
80.3
79.9
76.8
FregNet 59
64.2
66.9
83.1
55.1
69.8
81.6
81.5
57.7
50.4
61.2
74.2
82.6
70.2
55.8
68.0
Prellect
16
39.5
39.9
64.3
34.6
46.4
55.0
78.8
41.0
33.0
52.6
44.4
66.7
28.0
30.6
46.8
CNNSpot
[2
51.0
51.4
57.6
49.5
52.2
55.4
53.5
49.8
46.6
54,0
54.8
61.8
49.0
48.4
52.5
UnivED
63.4
65.3
66.6
30.7
55.9
62.2
85.3
70.8
49.7
92.3
54,9
70.3
53.8
63.5
48.0
48.9
50.0
58.6
61.6
AEROBLADE
96.7
56.1
62.0
77.7
76.9
57.8
54.1
59.8
ZaroFake
$7.1
87.7
81.5
82.2
70.1
82.9
67.5
84.2
46.0
47.0
54.0
$4.7
58.0
52.3
68.2
Ours
98.4
97.7
78.7
74,0
97.0
80.1
91.8
99.0
68.0
95.1
98.7
98.3
98.6
98.6
91.0
Table 3: Cross-paradigm generalization in terms of AP performance.
Method
Genlmage
New Geserator
AVG
SDL.4
SD1.5
ADM
DALLEE
Glide
VQDM
Wilkong
DALLES
Finelly
MIv5
SDNL
FLUX
NPR
$4.0
74.6
76.7
81.2
88.9
89.1
83.6
HoogNet 59
74.3
75.6
91.4
89.6
80.6
910.5
75.1
FroDrect
37.8
37.8
61.8
38.2
52.9
85.1
49.3
44.7
76.7
34.1
37.5
48.
CNNSpot
59.2
60.0
76.2
53.5
58.7
71.6
67.7
57.0
42.1
62.5
64.5
75.1
49.2
47.1
60.3
UniPD
86.7
86.4
87.3
63.2
75.0
84.4
96.7
91.5
50.4
99.3
77.9
92.7
50.1
77.5
79.9
SIDA"
53.1
52.3
65.3
71,9
69.7
50.9
40.5
72.7
93.5
61.3
69.5
63.8
96.4
91.7
68.1
ABRUBLADE ADE 48
58.2
98.9
8013
92.1
99.7
96.38
76.1
99.3
6806
75.3
86.9
79.2
97.0
94..3
88.0
MIBD
72.3
73.4
65.4
88.1
60.9
77.8
87.8
76.6
53.5
67.5
60.3
71.3
54.2
64.6
69.5
ZoroFakk
94.2
95.4
90.0
90.7
77.0
74.3
43.8
58.5
61.7
55.7
73.7
100.
99.8
4.2 Comparison to Baselines
To compare the generalization of our method with other approaches, following previous works 660
35 4
we consider two experiment settings, i.e., architereee and cross-paradigm. Specifically, models are trained on images generated by one type of GAN, and under these two settings, they are tested on images generated by other GANs and diffusion models respectively. SIDA [25] is an exception because their models need to be trained on customized datasets labeled with tampered regions and corresponding descriptions, hence we directly use the pre-trained models they provide for evaluation. Note that for zero-shot methods, including ours, these two settings are equivalent. To evaluate the performance of the proposed method, we use accuracy (Acc) and average precision (AP) metrics.
Cooss-Architecture Generalization. In order assess the generalization on images of GAN sources, we employ ForenSynths 62 for evaluation. Concretely, models are trained on the training set generated by ProGAN 277. which involves four types of images (cat, chair, car, and horse), and then evaluated on the test set containing other GANs. We report the results in table [
It can be observed that most supervised methods achieve good detection performance images generated by GANs. This is because images generated by different GAN architectures tend to share similar artifact patterns 14 62). Among frequency-basee and semantic-based approaches. NPR [60] and UnivFD [43] demonstrate the best performance. respectively. Regarding zero-shot detection methods, AEROBLADE and ZeroFake yields almost random results. On the contrary, our method and MIBD (7] present better detection performance, and our method outperforms MIBD 16.4% and 14.9 14.9% in terms of average Acc and AP, respectively. We note that although our analysis is based on sampling process of diffusion, we find our method can get promising performance on images generated by GANs.
Pooss-Paradigm Generalization. Due to the differences in artifact patterns between diffusion models and GANs 18 47 cross-paradigm poses more challenging problem. Following 60 43 68),
report the results of models trained on images generated by ProGAN from the ForenSynths dataset and tested on diffusion-generatee
images from other datasets. The Acc and AP results are presentd in table lnn t All supervised methods experience a significant drop in performance, especially on images generated by the new generators. UnivFD 43 despite achieving a promising AP, suffers from low accuracy due to differing optimal classification thresholds for images generated by diffusion models and GANs. SIDA (55 demonstrates high detection performance on some cutting-edge diffusion models, such as FLUX and DALLE3, but its effectiveness on other models still requires improvement. Notably, our method exhibits powerful performance on almost all diffusion models. In terms of average Acc and AP, our method outperforms the second-best approach, i.e., AEROBLADE by 11.9% % and 17.5 %, respectively. We also present the overall detection results of each method in table
7

---

Gaussian Bky
Coip
Table 4: Overall detection performance. We
report Acc and AP results of each method on the three datasets and the average results on the 21 generators.
PEGG
AP
AF
Asc
95.9
66.4
77.5
45.6
CNNSpe1
86.8
56.8
94.4
99.6
74.6
86.4
66.5
74.2
59.5
72.9
79.4
63.3
AEROBLADE
92.1
MIRD X
73.5
75.3
73.9
Qua
ZemPake
50.4
54.7
62.3
Oun
$9,9
97.4
89.6
97.3
92.9
97.8
90.6
97.5
Figure 5: Robustness evaluation on common per- turbations, measured in AP(%).
SD1.4
Midjoumay
DALLE2
ProGAN
GauGAN
StyleGAN
RAY
60-
6.7
Amcl
300+
Seal
Real
Rate
130
200
+0.00
Fack
TAm
MIBD
Figure 6: Similarity score distribution for different datasets. We count the number of samples of real and generated images in different score intervals.
Robustness Perturbations. Social media platforms tend to apply post-processing to user-uploaded images. To evaluate the robustness of our method under such conditions, we consider four common types of perturbations including Gaussian blur, center cropping, JPEG compression and resizing. We investigate the robustness of our method compared with other representative approaches under these perturbations. Experiments are conducted on the ForenSynths and GenImage datasets, with each type of perturbation applied at five different intensity levels. We report the overall AP across all settings in fig. Detailed results can be found in appendix AA.4
It can be observed that NPR (60), which relies heavily on significant performance degradation under common perturbations. In particular, JPEG compression, which tends to suppress high- frequency information, reduces its detection accuracy to near-random performance. While UnivFD perturbations. Moreover, compared to cropping and resizing, our method is more affected by blurring and JPEG compression. We hypothesize that this is because these two types corrupted image distributions deviate more significantly from training datasets of diffusion models, making it difficult for them to generate accurate predictions. However, our method still achieve the optimal average performance.
features in images, suffers
43 suffers significant performance degrade when countering blurring
8

---

Real
SD1.5
Table 5: Ablation study. Detection performance of our method with different vision foundation mod-
Time-des
Wieetee
See
els and features from different layers. Measured in AP (%).
3xe
Model
Layer
ForenSynths
Genlmage
New Generntor
AVG
92.9
Vit-/144
all
96.4
99.2
97.9
97.9
DINOv2
all
56.9
63.9
71.5
63.7
Figure 7: Feature visualization of denoising out- puts at different timesteps.
DINOv3
85.4
89.8
98.0
90.7
WT-1/14
last
all
97.4
87.6
71.2
97.3
97.8
91.3
97.5
82.4
4.3 Visualization
To verify the effectiveness of our method, we statistically analyzed the similarity scores of our method different generative models. We also visualized the distribution of scores from two other zero-shot methods, i.e., AEROBLADE and MIBD. As shown in fig. 66] our method demonstrates better separability across different generative models, whereas AEROBLADE and MIBD only show effectiveness on one paradigm of generator. For instance, although AEROBLADE achieves promising results on diffusion generated images, fails to distinguish GAN-generated images from real ones. In contrast, MIBD performs better on GAN-generated images but struggles with diffusion models. Foddls.Furthermore, we observed that the optimal decision threshold for our method remains consistently close to 0.75 across different datasets. This is a desirable property, as it implies that a unified threshold can be used to detect various generative models.
diffusion-generated
To further validate our previous conclusion that the denoising outputs of generated images converge more rapidly toward the target images, we visualize the features along the denoising trajectories. Specifically, we use samples generated by SD1.5 from the GenImage dataset along with real samples. For each image, we extract the CLIP embeddings of the denoised target images different denoising time steps and visualize them using UMAP (39, which preserves both global and local structure. The visualization results are shown in fig. 7 the features images generated by SD1.5 quickly become close to their final denoised states as early as step 750. In contrast, the features of real images change more gradually over time. This indicates that the denoising outputs generated images converge to final images more quickly.
4.4 Ablation Study
Importance of Fine-Grained Features. We evaluate the impact of incorporating features extracted from intermediate layers of the CLIP model on the performance of our method. Specifically, we assess the detection performance when using features from the last layer and from all layers of CLIP, respectively. It can be seen in table incorporating fine-grained features from intermediate layers can significantly improve the detection performance. addition, we report detailed detection performance of each layer in appendix appendix A.3
Effect of Vision Foundation Model. We also port the effect of using different vision foundation models in table Firstly, we employed CLIP mod- els with different architectures and evaluated their performance. It be observed that the small- est model, i.e., ViT-B/32, performs significantly worse than the others on the ForenSynths, while the ViT-H/14 14 achieves slight better results with the ViT-L/14. This indicates that our method can ben- efit from larger models. Note that, consistent with
Table Performance of our method across different diffusion models and timesteps. Mea- sured in AP(%)
Diffusion Medil
ForesSyaths
Gralmage:
New Generstor
AVG
SDLS
97.4
07.3
97.8
97.5
SD2.1 FLUX
92.5
92.7
95.9
93.6
84.8
88.3
81.9
85.3
SDI 1-1stgps
97.5
969
97.1
97.2
UnivFD
4 we report our previous results using the CLIP VIT-L/14 to ensure fairness. In addition, we also extract features using DINOv2 and DINOv3, two self self-supervised vision foundation models. DINOv2 performs significantly worse than the other models. We hypothesize that this because its training paradigm encourages the extraction of more robust features, making it less sensitive to fine- grained variations. In contrast, using DINOv3 as the feature extractor brings stronger performance as its ability capture fine-grained features is enhanced.

---

Different Diffusion Models and Timesteps. To verify the impact of different diffusion models on the performance of our method, we also evaluate our method with Stable Diffusion v2.1 (SD2.1) and FLUX, considering their open-source availability and popularity. Note that although FLUXX was proposed as a Flow Matching model, we still treat as a diffusion model in this context. Results in table (oole6]shone show that SD2.1 1 and FLUX achieve lower detection performance compared to SD1.5, with the FLUX based detector performing the worst. We speculate that this may be because FLUX can accurately predict the original image at the early stages of the generation process, which affects the progressive generation behavior of the denoising trajectory and partially disrupts the bias between real and fake images. Nevertheless, FLUX based detector still achieve promising results. Moreover, we test using fewer timesteps, 10 steps, and observe that our method can achieve similar results, indicating that it is not significantly suffered by detection efficiency issues.
Conclusions and Discussions
In this paper, we introduce a novel zero-shot method for detecting Al-generated images. Our approach is motivated by the observation that generated images exhibit faster convergence toward the target image along their denoising trajectories. To detect synthetic images, we perform DDIM inversion on the input image, collect intermediate denoising outputs, and compute their similarity to the original image- where generated images are expected exhibit higher similarity. Since our method does not rely on generated images for training, it avoids overfitting to specific generative models or datasets and demonstrates strong generalization capabilities. We believe our work will inspire future research to further explore informative features embedded in the image generation process itself.
Limitations. Although our method demonstrates strong generalization capabilities, its performance may degrade when applied to severely corrupted images, such as those that have undergone heavy compression or significant blurring. This may be primarily due such images deviate substantially from the data distribution learned by diffusion models, making it difficult for the model to accurately predict the original image. Currently, we compute the final score by directly averaging the similarity scores obtained from different timesteps and CLIP layers. In the future, we plan to develop an adaptive weighting scheme to assign importance dynamically, which is expected to further improve detection performance.
Broader Impacts. Our work aims to combat misinformation and enhance the credibility of content on social media platforms. The generation and detection of synthetic images form long-term adversarial game. As generative models continue evolve and improve, it becomes essential to incorporate diverse approaches for effective detection. We hope our work will inspire further research into discovering and leveraging new forensic cues for identifying Al-generated images.
6 Acknowledgement
This work has been supported by the Youth Innovation Promotion Association, CAS (No.2021 155).
References
[1] Midjourney.
2025.
[2] httree//ilhaacchapprrr...aaaaeed
2025.
[3] Martin Arjovsky, Soumith Chintala, and Iéónn Bottou. Wasserstein generative adversarial networks. In International conference machine learning. pages 214-223, PMLR. 2017.
[4] Quentin Bammcy. Synthbuster: Towards detection of diffusion model generated images. IEEE Open Journal of Signal Processing, 5:1-9, 2023.
[5] James Betker, Gabriel Goh, Li Jing, Tim Brooks, Jianfeng Wang, Linjie Li, Long Ouyang, Juntang Zhuang, Joyce Lee, Yufei Guo, al. Improving image generation with better captions. Computer Science. https://ddn. openai. com/papers/dallle-3. pdf. 2(3):8, 2023.
[6] Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale training for high fidelity natural image synthesis. In International Conference Learning Representations, 2018
10

---

[7] Jonathan Brokman, Amit Giloni, Omer Hofman. Roman Vainshtein. Hisashi Kojima. and Guy Gilboa. Manifold induced biases for zero-shot and few-shot detection of generated images. In The Thirteenth International Conference on Learning Representations. 2025.
[8] George Cazenavette, Avneesh Sud, Thomas Leung, and Ben Usman. Fakeinversion: Learning detect. images from unseen text-to-image models by inverting stable diffusion. Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition, pages 10759-10769, 2024.
[9] Yunjey Choi, Minje Choi, Munyoung Kim, Jung- Woo Ha, Sunghun Kim, and Jacgul Choo. Stargan: Unified generative adversarial networks for multi-domain image-to-img to- translation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 8789 8797988777400 2018.
[10] Davide Cozzolino, Giovanni Poggi, Matthias Nießner, and Luisa Verdoliva. Zero-shot detection of ai di-generated images. In European Conference Computer Vision, pages 54-72. Springer, 2024.
[11] Prafulla Dhariwal and Alexander Nichol. Diftusion models beat gans image synthesis. Advances in neural information processing systems, 34:8780- 8794, 2021.
[12] Sander Dieleman. Diffusion spectral autoregression, 2024.
[13] Ricard Durall, Margret Keuper, and Janis Keuper. Watch your up co-oovoolttio: Can based generative deep neural networks are failing to reproduce spectral distributions. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 7890 7890-7899, 2020.
[14] Tarik Dzanic, Karan Shah, and Freddic Witherden. Fourier spectrum discrepancies in deep network generated images. Advances in neural information processing systemx, 33:3022-3032, 2020.
[15] Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müllrr, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first international conference on machine learning, 2024.
[16] Fabian Falek, Teodora Pandeva, Kiarash Zahirnia, Rachel Lawrence, Richard Turner, Edward Meeds. Javier Zazo, and Sushrut Karmalkar. A fourier space perspective on diffusion models. arXiv preprint arXiv:2505. 12278, 2025.
[17] Jean- Yves Franceschi, Mike Gartrell, Ludovic Dos Santos, Thibaut Issenhuth, Emmanuel de Bézenac, Mickaël Chen, and Alain Rakotomamonjy. Unifying gans and score-based diffusion as generative particle models. Advances in Neural Information Processing Systems, 36:59729-59760, 2023.
[18] Joel Frank, Thorsten Eisenhofer, Lea Schönherr, Asja Fischer, Dorothca Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. In International conference on machine learning, pages 3247-3258. PMLR, 2020.
[19] Yuan Gao, Yuling Jiao, Yang Wang, Yao Wang, Can Yang, and Shunkang Zhang. Deep generative learning via variational gradient flow. In International Conference on Machine Learning, pages 2093-2101. PMLR, 2019.
[20] Amin Ghiasi, Hamid Kazemi, Eitan Borgnia, Steven Reich, Manli Shu, Micah Goldblum, Andrew Gordon Wilson, and Tom Goldstein. What do vision transformers learn? a visual exploration. arXiv preprint axXiv:22/..06727, 2022.
[21] Ian J Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014.
[22] Shuyang Gu, Dong Chen, Jianmin Bao, Fang Wen, Bo Zhang, Dongdong Chen, Lu Yuan, and Baining Guo. Vector quantized diffusion model for text-to-image synthesis. In Proceedings of the IEEE/CV conference on computer vision and pattern recognition, pages 10696-10706, 2022.
[23] Zhiyuan He, Pin- Yu Chen, and Tsung- Yi Ho. Rigid: training free and model aggossic framework for robust ai ai-generated image detection. arXiv preprint arXiv:2405.20 20,112 2024.
[24] Jonathan Ho, Ajay Jain, and Picter Abbcel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851, 2020.
[25] Zhenglin Huang, Jinwei Hu, Xiangtai Li, Yiwei He, Xingyu Zhao, Bei Peng. Baoyuan Wu, Xiaowei Huang. and Guangliang Cheng. Sida: Social media image deepfake detection, localization and explanation with large multimodal model. arXiv preprint orXiv:2412.04292, 2024.

---

[26] Dongsheng Jiang, Yuchen Liu, Songlin Liu, Jin'e Zhao, Hao Zhang, Zhen Gao. Xiaopeng Zhang, Jin Li, and Hongkai Xiong. From clip dino: Visual encoders shout in multi-modal large language models. arXiv preprint arXiv:2310.0888 2310008255 2023.
[27] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. In International Conference on Learning Representations, 2018.
[28] Tero Karras, Samuli Laine, and Timo Aila, A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVE conference on computer vision and pattern recognition, pages 2019.
[29] Tero Karras, Samuli Laine, Miik Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In Proceedings of the IEEF/CVF conference computer vision and puttern recognition, pages 1110-8119, 2020.
[30] Black Forest Labs. Flux. https:///ithhb: http::://gttuub..c//bbac-- wttp://ooooeeee-ooeo---aaaaeeee- wowes-ooootstststttoeeeeeee labs/fuu 2024.
[31] Xin Lai, Zhuotao Tian, Yukang Chen, Yanwei Li, Yuhui Yuan, Shu I Liu, and Jiaya Jia. Lisa: Reasoning segmentation via large language model. In Proceedings of the IEEF/CVF Conference on Computer Vision and Puttern Recognition. pages 9579-9589, 2024.
[32] Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Fuli Feng. Improving synthetic image detection towards generalization: An image transformation perspective. arXiv preprint arXiv:2408.067 2024.
[33] Tsung-Ye Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer vision-ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part 13, pages 740-755, 750. Springer, 2014.
[34] Bo Liu, Fan Yang, Xiuli Bi, Bin Xiao, Weisheng Li, and Xinho Gao. Detecting generated images by real images. In European Conference on Computer Vision, pages 95-110. Springer, 2022.
[35] Huan Liu, Zichang Tan, Chuangchuang Tan, Yunchao Wei, Jingdong Wang, and Yao Zhao. Forgery- aware adaptive transformer for generalizable synthetic image detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10770-1000 10780, 2024.
[36] Zihan Liu, Hanyi Wang, Yaoyu Kang, and Shilin Wang. Mixture of low-rank experts for transfcrable ai-generated image detection. arXiv preprint 2rXiv:2404.04883 2024.
[37] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pages 3730 0708,,37..110 2015.
[38] Ruipeng Ma, Jinhao Duan, Fei Kong, Xiaoshuang Shi, and Kaidi Xu. Exposing the fake: Effective diffusion-generraeed images detection. arXiv preprint arXiv:2307.06272 2023.
[39] Leland Mcinnes. John Healy, Nathaniel Saul, and Lukas GroBberger. Umap: Uniform manifold approxi- mation and projection. Journal of Open Source Software, 3(29):861, 2018
[40] Tai Nguyen, Aref Azizpour, and Matthew Stamm. Forensic self-deseriptions are all you need for zero-shot detection, open-set source attribution, and clustering ai-generated images. arXiv preprint arXiv:2503.22 1003, 2025.
[41] Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob Mcgrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. In International Conference Machine Learning, pages 16784-16804. PMIRR 2022.
[42] Sophie J Nightingale and Hany Farid. Ai-synthesized faces are indistinguishable from real faces and more trustworthy. Proceedings of the National Academy of Sciences, (19()))212008111) 2022.
[43] Utkarsh Ojha, Yuheng Li, and Yong Jac Lee. Towards universal fake image detectors that generalize across gencrative models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24480-24489, 2023.
[44] Taesung Park, Ming Yu Liu, Ting-Chun Chun Wang, and Jun Yan Zhu. Semantic image synthesis with spatially- adaptive normalization. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2337-2346, 2019.
12

---

[45] Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna. and Robin Rombach. SDXL: Improving latent diffusiin models for high-resolution image synthesis. In The Twelfth International Conference on Learning Representations. 2024.
[46] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 9748-8763. PMLR, 2021.
[47] Jonas Ricker, Simon Damm, Thorsten Holz, and Asja Fischer. Towards the detection of diffusion model deepfakes. arXiv preprint arXiv:2210. 14..211, 2022.
[48] Jonas Ricker. Denis Lukovnikov, and Asja Fischer. Aeroblade: Training-free free detection of latent diffusion images using autoencoder reconstruction error. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pottern Recognition, pages 9130-9140, 2024.
[49] Severi Rissanen, Markus Heinonen, and Arno Solin. Generative modelling with inverse heat dissipation. arXiv preprint arXiv:2206.14 13397, 2022.
[50] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684-10695, 2022.
[51] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang. Andrej Karpathy, Aditya Khosla, Michael Bersstcin, Alexander C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV), 115(3):211-252, 2015.
[22] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang. Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journall of computer vision, 115:211- 252, 2015.
[53] Zeyang Sha, Yicong Tan, Mingjie Li, Michael Backes, and Yang Zhang. Zerofake: Zero-shot detection of fake images generated and edited by text-to-image generation models. In Proceedings of the 2024 on ACM SIGSAC Conference Computer and Communications Security, pages
2024.
[54] Jascha Sohl- Sohl-Dicksteen, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilirium thermodynamics. In International conference on machine learning, pages 2256-2265. pmlr, 2015.
[55] Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint 22X2020000.02002, 2020.
[56] Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. Advances in neural information processing systems, 32, 2019.
[57] Yang Song and Stefano Ermon. Improved techniques for training score-based generative models. Advances in neural information processing systems, 33:12438-12443 2020.
[58] Yang Song, Jascha Sohl-Dickstein, Diederik Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021.
[59] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei, Frequency-aware deepfake detection: Improving generalizability through frequency space domain learning. In Proceedings of the AAAI Conference Artificial Intelligence, volume 38, pages
2024.
[60] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethinking the up- sampling operations in enn-based generative network for generalizable deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 28130-28139, 2024.
[61] Yael Vinker, Ehsan Pajouheshgar, Jessica Y Bo, Roman Christian Bachmann, Amit Haim Bermano, Daniel Cohen-Or, Amir Zamir, and Ariel Shamir. Clipasso: Semantically object sketching. ACM Transactions on Graphics (TOG), -14) 2022.
[62] Sheng- Yu Wang, Oliver Wang. Richard Zhang. Andrew Owens, and Alexei A Efros. lan-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages
2020.
13

---

[63] Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu. Hong Chen, and Houqiang Li. Dire for diffusion--gmerraeel image detection. Proceedings of the IEEE/CVF International Conference on Computer Vixion, pages 22445-244 22455, 2023.
[64] Zhenting Wang, Chen Chen, Yi Zeng. Lingjuan Lyu, and Shiqing Ma. Where did i come from? origin attribution of ai-generated images. Advances neural information processing systems, 36:74478-74500
2023.
[65] Mingxuan Zhanxing Zhu, and Song Liu. Monoflow: Rethinking divergence gans via the perspective of wasserstein gradient flows. International Conference on Machine Learning, pages 39984 40000. PMLR, 2023.
[66] Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song. Thomas Funkhouser, and Jianxiong Xiao. Lsun: Con- struction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv:1506.0m 15066033666,, 2015.
[67] Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEF/CVF International Conference Computer Vision, pages 3836-3847, 2023.
[68] Nan Zhong, Yiran Xu, Sheng Li, Zhenxing Qian, and Xinpeng Zhang. Patchcraft: Exploring texture patch efficient ai-generated image detection. arXiv preprint arXiv:231111239,, 2023.
[69] Jun- Yan Zhu, Taesung Park, Phillip Isola, and Alexci A Efros. Unpaired image-to-image translation using cycle-consistent adversarial networks. In Proceedings the IEEE international conference on computer vision, pages 2223 22222, 2017.
[70] Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Jie Hu, and Yunhe Wang. Genimage: million-scale henchmark for detecting ai- ai-generated image. Advances in Neural Information Processing Systems, 36:77771-77782, 2023.
14

---

A Appendix
A.1 Compared Baselines
: extracts high-frequency information by performing Fourier transforms in both the pixel space and the feature space. NPR [60]: resamples images by first downscaling and then upscaling them, and computes the residuals with respect to original images to capture local pixel relationships. Since this approach captures low-level features similar to the high-frequency components of images, we also categorize it as frequency-basee
Supervised Detectors. 1) FreDeet
[8] detector trained on the DCT space. 2) FreqNet [59]
method. 4) CNNSpot [2]] a detector fine-tuning pretrained 4 this method uses the CLIP model to project images into a unified feature space, followed by single linear layer for classification. 6) SIDA [25] it fine-tunes pretrained large multimodal model using custom dataset annotated with tampered labels. The trained model can provide detailed information related to fake contents. To compute the AP for this method, we use the logits before the softmax outputs as probabilities for real and fake.
ResNet. 5) UnivFD
Zero-Shot Detectors. 1) AEROBLADE 48 This method identifies images generated by latent diffusion models by reconstructing the original image using VAE. 2) ZeroFake [53]: This method performs DDIM inversion on the image, modifies the prompt during reconstruction, and uses the SSIM between the reconstructed image and the original to identify fake images. 3) MIBD (7]:
perturbs the image with noise and uses the similarity between original images and the noises predicted by a diffusson model as the detection criteria values.
A.2 Datasets
ForenSynths.
The test set contains images generated by 7 types of GAN, namely ProGAN 27].
GauGAN 44
BigGAN (6). StarGAN 99) CycleGAN (69), StyleGAN (88 and StyleGAN2 29
GenImage. It includes 8 diffusion models: Stable Diffusion V1.4 500, Stable Diffusion V.15 50
ADM 11 DALLE2, Midjourney [1) Glide [41] VQDM (22,, and Wukong (2).
New Generator. We download the corresponding fake images based on the prompts of each real image, thereby avoiding semantic
of COCO2017, and use generative models produce
bias. The new generators include Stable Diffusion v3 [15] FLUX (0). Stable Diffusion XL 45).
DALLE3 (5). Firefly and Midjourney-v5 M. We present some examples in fig. g
J.Morran
Real
SD3
FLUX
Figure 8: Examples of real images and corresponding generated images.
A.3 Examples of Denoising Outputs
We perform DDIM inversion on the input image to simulate its generative process, and collect the denoised outputs at each timestep to compute their similarity with the original image. In fig. g
15

---

Real
SD1.5
FLUX
Timestop
400
Figure 9: Examples denoising outputs at different timesteps.
present some examples of predicted images along the denoising trajectories for both real and generated images.
A.4
Robustness Experiments
Table 7: Average robustness common perturbations. We report the average AP (%) scores of different methods over each type of perturbations at all intensity levels.
Method
Clean
Blur
Crop
JPEG
Resize
AVG
NPR 660
88.4
78.9
89.5
57.9
88.3
80.6
UnivED
43
91.3
73.2
94.8
78.5
89.0
85.4
MIBD 7
78.7
69.8
79.6
72.3
76.8
75.4
Ours
97.3
81.3
98.1
80.7
95.5
90.6
To evaluate the robustness of method, we apply four common types of perturbations typically encountered on social media platforms, each with five levels of intensity. We compare our approach with state-of-the-an methods from each category, namely NPR (60), UnivFD (43) and MIBD (7).
In table 7
we report the average AP of each method under different types of perturbations.
A.5 Ablation Study on CLIP Layer
To further verify the importance of the intermedi- ate features of CLIP, we extract the features from each layer of CLIP (ViT-L/14) image embed- dings and test the detection performance of our method. As shown in fig. 10, the features tracted from the 15th intermediate layer achieve the best performance, and the results from these middle layers are significantly better than those from the early and late layers. Moreover, the variation in detection performance across differ- ent layers is closely correlated with the curves presented in fig.
80
60
Diffusion
Overall
Layer
Figure 10: Detection performance of different layer.
16

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
We have faithfully describe our contributions in the abstract and introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how be expected to generalize other settings.
much the results
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We have discussed the limitations of our method in the conclusion section.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
17

---

Justification:
We provide clear descriptions or references of the relevant theoretical assump-
tions.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We have provided a thorough description the settings of our method, including the models, datasets and implementation details.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
18

---

reproducible, they Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We have provided project demo the supplementary material, and we will open the source code once our paper gets published.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cm cc/
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/
Cotee//ddeeeSbmmmcia ssi onPolicy) for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We specify the key configurations about the implementation details in the experiment section.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: Error bars reported because it would be computationally expensive.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
19

---

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative rates).
show in tables or
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [No]
Justification: We provide the type of GPU used in our experiments. While we not report the execution time for each experiment, this metric is not particularly relevant to our task.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics httpghgttt/////eeprrooccoooo/coe
Answer: [Yes]
Justification: Our researches conducted in this paper conform with NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the potential societal impacts of this work in the conclusion section.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
20

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
Our research poses such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We have cited the original papers that produced the code packages or datasets. And we also state the versions of the assets are used.
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
21

---

If assets are released, the license, copyright information, and terms of use in the thcode. has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
latasets.paperssi
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
We do not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: Our paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
22

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does involve LLMs as any important components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM for what should or should not be described.
23


Reviews:
[{"review_id": "7mISJzLc9N", "reviewer": "Reviewer_kuMt", "summary": "This paper proposes a novel zero-shot method for detecting AI-generated images by analyzing the convergence behavior of images under simulated DDIM inversion. The key insight is that generated images tend to converge more quickly toward a final image when passed through a reversed diffusion trajectory, compared to real images. The method is evaluated across a range of datasets, including both GAN and diffusion-based generators.", "questions": "See weaknesses above, esp. the full method should be described in detail.", "limitations": "See above.", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 1, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1.\tOriginal Insight: The observation that generated images converge faster than real images during simulated denoising is interesting and novel, despite being conceptually related to prior works.\n\n2.\tBreadth of Evaluation: The experimental setup is broad, spanning multiple generative models (GANs, diffusion, commercial models) and datasets. While DALLE 3 is used as a commercial model, it would have been more appropriate to include the more advanced gpt-image-1, which is currently the state-of-the-art for text-to-image generation. However, given that API access was released close to the submission deadline, the omission is understandable, but still worth noting. Additional robustness experiments are provided in the appendix, aligning with common expectations in this field.\n\nMajor Weaknesses:\n1.\tClarity and Completeness of Method Description: The most significant issue is the poor and incomplete presentation of the core method. The actual computation of the proposed detection criterion is not formally described. For example, averaging cosine similarities across steps and layers is only briefly mentioned in the limitations section. Section 3.2 lacks formality, and the only equation provided suggests a sum (not average) over similarities without specifying how inner-layer representations are handled. Readers should not be required to inspect the code to understand the core algorithm. Additionally, important details like which diffusion model is used for DDIM inversion are missing. An ablation study on how the diffusion models affects results is also recommended.\n\n2.\tSection 2.2 omits all relevant zero-shot detection methods. AEROBLADE [47] and MIBD [7] are only discussed later in the paper and should be introduced in the related work section. This omission is critical, as both methods share some similar assumptions with this work and are conceptually aligned in meaningful ways.\na.\tAEROBLADE also relies on the hypothesis that real and generated images interact differently with internal components of a diffusion model, which is conceptually similar to simulating the diffusion process as a behavioral signal.\nb.\tMIBD uses a combination of CLIP embeddings and a forward diffusion process in Stable Diffusion, closely paralleling this paper's use of CLIP embeddings and DDIM inversion. Both assume that generative origin can be inferred from differences in how images behave under diffusion-based transformations.\nWhile the method is novel, these conceptual similarities are not acknowledged in Section 2 or elsewhere. Properly crediting related work would strengthen the paper’s framing and more clearly position its contribution within the existing literature.\n\n3.\tFurthermore, additional relevant work is completely missing: \na.\tZED - D. Cozzolino et al ,  Zero-shot detection of ai-generated images, ECCV 2024.\nb.\tRigid - Zhiyuan He et al. Rigid: A training-free and model-agnostic framework for robust ai-generated image detection. arXiv preprint arXiv:2405.20112, 2024.\nThe authors are encouraged to include a direct comparison to ZED (a), given its relevance as a recent zero-shot detection method published at ECCV 2024. While Rigid (b) is currently a preprint, it is still relevant and should be cited and briefly discussed for completeness.\n\n4.\tWriting Quality: The paper contains numerous grammatical and stylistic errors (e.g., line 74: starting a sentence with \"And…\", line 142: repeated words like \"as as\"). These issues appear throughout the paper and make it difficult to read and understand. While writing quality alone is not typically a reason for rejection, in this case it seriously impairs the communication of the core ideas. A substantial revision is needed to bring the writing to an acceptable standard for publication.\n\nMinor Weaknesses:\n1.\tTerminology Consistency: The paper conflates synthetic images and deepfakes, which are well-differentiated in the literature. Clarifying this distinction would improve conceptual accuracy.\n\n2.\tIncorrect or Misleading Plots: Figure 6 appears to contain repeated plots for different generator-method combinations (e.g., ProGAN and StyleGAN for AEROBLADE and MIBD; Midjourney and DALL·E 2 for MIBD), even though Table 1 shows very different results for these cases. This suggests that the plots were either copied incorrectly or generated improperly. This reflects careless figure preparation and further contributes to the poor overall presentation of the paper.\n\n3.\tLow GLIDE Results for MIBD: The reported results for MIBD on GLIDE-generated images are not consistent with the original MIBD paper. This discrepancy raises concerns about either the evaluation setup or implementation and warrants rechecking. It is recommended that the authors verify this test to ensure correctness.\n\n4.\tMost other zero-shot detection methods are relatively lightweight and efficient. In contrast, this method performs full DDIM inversion, which is both time- and resource-intensive. An analysis of runtime and computational cost would help contextualize its practicality compared to existing approaches.", "was_revised": true, "final_justification": "Following the rebuttal answers I am raising my final rating.", "rebuttal": "Dear Reviewer kuMt, we thank you for recognizing the novelty of our work and for your careful review. We will first address the specific questions you raised, then provide a general response regarding the clarity issues.\n\n>**Q1: It would have been more appropriate to include the more advanced gpt-image-1, which is currently the state-of-the-art for text-to-image generation**\n\n**A1**: Thanks for your helpful review. As you mentioned, this API access was released close to the submission deadline. However, we have now conducted the experiment. We use the captions of real images from the New Generator as prompts and generate the corresponding fake images via API. The detection results are as follows (measured in AP):\n\n| Method |  AP  | Acc  |\n|:------:|:----:|:----:|\n| Ours   | 99.9 | 98.2 |\n\nWe note that although GPT-generated images exhibit high visual quality, this does not necessarily make them more difficult to detect, which is consistent with findings from recent studies[7].\n\n>**Q2: An ablation study on how the diffusion models affects results is also recommended.**\n\n**A2**: Thanks for your valuable advice. In this paper, we conducted experiments using the SDv1.5 model. According your suggestion, we also evaluated our method with SDv2.1 and FLUX, considering their open-source availability and popularity. Note that although FLUX was proposed as a Flow Matching model, we still treat it as a diffusion model in this context. The experimental results are as follows (measured in AP):\n| Diffusion Model | ForenSynths | GenImage | New Generator |  AVG  |\n|:---------------:|:-----------:|:--------:|:--------------:|:-----:|\n|     SDv1.5      |    97.4     |  97.3    |     97.8       | 97.5  |\n|     SDv2.1      |    92.5     |  92.7    |     95.9       | 93.6  |\n|      FLUX       |    84.8     |  88.3    |     81.9       | 85.3  |\n\nSDv2.1 and FLUX achieve lower detection performance compared to SDv1.5, with the FLUX based detector performing the worst. We preliminarily speculate that this may be due to FLUX’s Transformer-based architecture, while most of the generators used in our experiments are CNN-based. The differences in induced bias between the two architectures may explain the performance gap. Nevertheless, FLUX based detector still achieve promising results. We will include these findings in the ablation study section of the revised version. Thank you again for your suggestion, which will make our work more complete.\n\n>**Q3:  Section 2.2 omits all relevant zero-shot detection methods.**\n\n**A3**: Thanks for your valuable review. First, we would like to clarify that we have provided sufficient introduction of the three zero-shot methods in the main text (lines 184–188) and Appendix A.1 (lines 511–516). We did not introduce zero-shot detection methods in Section 2.2 because the current mainstream detection approaches, i.e., high-frequency-based and semantic-based methods, cannot categorize them properly. Their underlying principles are also different from each other.\nMoreover, we would like to emphasize that although other zero-shot methods also utilize diffusion models, our method is notably different from them. It is the first to leverage the intermediate denoising trajectory images in the diffusion process for detection. AEROBLADE[1] employs VAE reconstruction (line 511), while MIBD[2] computes similarity between the original image and noise (line 515). We believe there is a clear distinction between our method and the others, which is why we did not explicitly highlight this point in our paper.\n\n>**Q4: Additional relevant work is missing, including ZED[3] and Rigid[4]. The authors are encouraged to include a direct comparison to ZED , and Rigid should be cited and briefly discussed for completeness.**\n\n**A4**: Thanks for your careful review. We have cited ZED[3] in Sec 2.2 (line 90). However, to the best of our knowledge, ZED has not released its source code, which makes it difficult for us to reproduce their results. Although their paper includes detection results on some of the same generators, we note that their evaluation was conducted on the dataset they collected themselves, further preventing a direct comparison with our method. Regarding Rigid[4], we will cite it in the revised paper.\n\n>**Q5: Low GLIDE Results for MIBD: The reported results for MIBD on GLIDE-generated images are not consistent with the original MIBD paper…**\n\n**A5**: Thanks for your careful review. We are confident that we used the official MIBD source code and our experimental results are correct. Through careful check, we found that the inconsistent result arises from the fact that the Glide dataset used by MIBD is collected from the UniversalFakeDetect dataset[5], whereas the Glide images we used come from GenImage[6]. Furthermore, we noticed that the former used images generated with 100 and 50 sampling steps, while the latter used 1000 steps, resulting in higher-quality images. We suspect this is the main reason why our results on Glide differ from those reported in the original paper.\n\n>**Q6: Most other zero-shot detection methods are relatively lightweight and efficient. In contrast, this method performs full DDIM inversion, which is both time- and resource-intensive...**\n\n**A6**: Thanks for your insightful review. Here, we provide a brief analysis of the computational cost of our method and compare it with other zero-shot approaches. To facilitate the comparison, we report the number of function evaluations (NFE) required to detect one image for each method. The detailed results are as follows:\n\n|         | AEROBALDE | MIBD | ZeroFake | Ours-50steps | Ours-10steps |\n|:-------:|:---------:|:----:|:--------:|:------------:|:------------:|\n|  NFE    |    <1     |  8   |   1019   |      50      |      10      |\n|  AP     |   73.5    | 73.9 |   65.5   |     97.5     |     97.1     |\n\nAEROBLADE performs a simple VAE reconstruction, which is less time-consuming than one diffusion model evaluation. MIBD by default uses 8 noise samples per image, while ZeroFake performs a full 999-step forward noising and a 20-step reverse denoising process(refer to Sec 4.3 of their paper). We also include the results of our method using a 10-step DDIM inversion, as we found it can achieve similar performance (refer to the Response 5 to the Reviewer RcDX). ZeroFake incurs significantly higher computational cost compared to other methods. Although our method requires more computation than AEROBLADE and MIBD, it brings over a 25% improvement in detection performance.\n\n>**Q7: Regarding the issues of clarity and writing quality of our paper.**\n\n**A7**: First, we apologize for any confusion caused by our oversight or typos that may have made our method description unclear. We perform DDIM inversion using SD v1.5. When computing the similarity, we calculate the average cosine similarities across steps and layers, and we acknowledge that the term $1/T$ was mistakenly omitted in Equation (5). Moreover, figure 6 indeed has the issue you pointed out, and Tables 1–3 provide the accurate results.\nWe will carefully revise and polish our paper to improve its clarity.\nHowever, we sincerely ask you to consider the contributions of our work, which we believe outweigh these clarity issues.\n\n[1] Ricker, et al. Aeroblade: Training-free detection of latent diffusion images using autoencoder reconstruction error, CVPR 2024.\n\n[2] Brockman, et al. Manifold induced biases for zero-shot and few-shot detection of generated images, ICLR 2025.\n\n[3] Cozzolino et al , Zero-shot detection of ai-generated images, ECCV 2024.\n\n[4] He et al. Rigid: A training-free and model-agnostic framework for robust ai-generated image detection. arXiv preprint arXiv:2405.20112, 2024.\n\n[5] Ojha, et al. Towards universal fake image detectors that generalize across generative models, CVPR 2023.\n\n[6] Zhu, et al. Genimage: A million-scale benchmark for detecting ai-generated image, NeurIPS 2023.\n\n[7] Yan, et al. GPT-ImgEval: A Comprehensive Benchmark for Diagnosing GPT4o in Image Generation. arXiv preprint arXiv:2504.02782, 2025."}, {"review_id": "EzudeUeyPp", "reviewer": "Reviewer_SMhx", "summary": "The authors propose a zero-shot method for synthetic image detection. The method is based on the observation that during the diffusion generation process, the synthetic images have a faster convergence than real ones. In particular, the proposed method reproduces the diffusion generation process of the image using DDIM inversion [53] and evaluates at each timestep the similarity between the original image and the denoised version comparing the features extracted from intermediate layers of CLIP.\n\nThe experimental section compares the performance of the proposal with respect to literature zero-shot methods [47,7,51] to detect images generated both by GANs and by Diffusion Models.", "questions": "- Figure 3 should be better described.\n- An ablation analysis using different diffusion models for the proposal should be included.\n- Evaluating the proposal for detecting autoregressive models could be interesting.\n\n\nMissing reference:\nZ. He, et al. “Rigid: A training-free and model-agnostic framework for robust ai-generated image detection.” arXiv preprint arXiv:2405.20112, 2024", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- The main idea is clear. Moreover, the authors report all the details to reproduce the proposed technique.\n - The results show that the proposed method obtains SoTA performance also with post-processing operations.\n\n\nWeaknesses:\n- Figure 3 is not clear. What is the meaning of this figure? How is the separation of the three stages determined?\n- The proposal adopts as diffusion model a Stable Diffusion V1.5 [48]. An analysis considering different diffusion models should be included.\n- How does the proposal perform on other types of generative models, such as autoregressive models [A]?\n\n[A] A. El-Nouby, et al. \"Scalable pre-training of large autoregressive image models.\" arXiv preprint arXiv:2401.08541 (2024).", "was_revised": true, "final_justification": "The proposed idea is novel and interesting. Moreover, the authors addressed most of the concerns of all reviewers.", "rebuttal": ">**Q1: Figure 3 should be better described. What is the meaning of this figure? How is the separation of the three stages determined?**\n\n**A1**: Thanks for your valuable review. Figure 3 shows the L2 distance from each point, ${\\hat{x}}_0(x_t)$, in the denoising trajectory to the straight line connecting the two endpoints, $x_0-{\\hat{x}}_0(x_T)$. The linearity and non-linearity stage of the curve approximately reflect the three stages of the denoising trajectory. Since it is difficult to theoretically derive an exact threshold to segment these three stages, we manually performed a rough separation near the peak of the curve based on the curvature of each point.\nOur goal is to use this figure to demonstrate the linear–nonlinear–linear structure of the denoising trajectory and show that fake images enter the second and third stages more quickly. This supports the hypothesis that the denoising outputs of generated images converge to original image faster. We will provide additional explanation for Figure 3 in the revised manuscript to enhance the clarity of our paper.\n\n>**Q2: An ablation analysis using different diffusion models for the proposal should be included.**\n\n**A2**: Thanks for your constructive review. In this paper, we conducted experiments using the SDv1.5 model. According your suggestion, we also evaluated our method with SDv2.1 and FLUX, considering their open-source availability and popularity. Note that although FLUX was proposed as a Flow Matching model, we still treat it as a diffusion model in this context. The experimental results are as follows (measured in AP):\n| Diffusion Model | ForenSynths | GenImage | New Generator |  AVG  |\n|:---------------:|:-----------:|:--------:|:--------------:|:-----:|\n|     SDv1.5      |    97.4     |  97.3    |     97.8       | 97.5  |\n|     SDv2.1      |    92.5     |  92.7    |     95.9       | 93.6  |\n|      FLUX       |    84.8     |  88.3    |     81.9       | 85.3  |\n\nSDv2.1 and FLUX achieve lower detection performance compared to SDv1.5, with the FLUX based detector performing the worst. We preliminarily speculate that this may be due to FLUX’s Transformer-based architecture, while most of the generators used in our experiments are CNN-based. The differences in induced bias between the two architectures may explain the performance gap. Nevertheless, FLUX based detector still achieve promising results. We will include these findings in the ablation study section of the revised version. Thank you again for your suggestion, which will make our work more complete.\n\n>**Q3: Evaluating the proposal for detecting autoregressive models could be interesting.**\n\n**A3**: Thanks for your valuable suggestion. We kindly point out that the AIM model [1] is a vision encoder rather than a generative model, similar to CLIP and DINO. To evaluate our method on images generated by an autoregressive model, we choose Infinity[2] 8B model, the current state-of-the-art in autoregressive generation. We use the captions of real images from the New Generator as prompts to generate the corresponding fake images, in order to avoid introducing semantic bias. We found that our method also achieves strong detection performance. Specifically,\t\n\n|    |  AP  | Acc  |\n|:----:|:----:|:----:|\n| Ours | 100. | 96.1 |\n\n[1] A. El-Nouby, et al. Scalable pre-training of large autoregressive image models. arXiv preprint arXiv:2401.08541 (2024).\n\n[2]Jian Han, et al. Infinity: Scaling bitwise autoregressive modeling for high-resolution image synthesis, CVPR 2025."}, {"review_id": "AGzmOEj0Fm", "reviewer": "Reviewer_b9Au", "summary": "This paper introduces a novel zero-shot method for detecting AI-generated images by analyzing the denoising trajectory during the image generation process. They  compute the similarity between the original image and the outputs along the denoising trajectory, which is then used as an indicator of image authenticity.", "questions": "See Weaknesses", "limitations": "See Weaknesses", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\nThe paper’s core contribution—leveraging denoising trajectory dynamics for zero-shot detection is noval. As a  zero-shot method, it eliminates the need for costly data collection and model training, making it scalable and accessible.\n\nWeaknesses\n1. The method’s performance degrades significantly under Gaussian blur or JPEG compression (Figure 5), with AP dropping to ~80% under these perturbations.\n2. Key details for reproducibility are missing, such as hyperparameter tuning and exact prompts for \"New Generator\" images.", "was_revised": true, "final_justification": "I would like to thank the authors for their rebuttal. Some of my concerns have been partially addressed, and the authors have provided helpful clarifications. I will maintain my current score, but I encourage the authors to incorporate the contents of the rebuttal into the main paper, as doing so would significantly strengthen it.", "rebuttal": ">**Q1: The method’s performance degrades significantly under Gaussian blur or JPEG compression (Figure 5), with AP dropping to ~80% under these perturbations.**\n\n**A1**: Thanks for your careful review. Compared to cropping and resizing, Gaussian blur and JPEG compression cause more severe damage to image details, which can destroy forgery traces and alter the image distribution. These two types of perturbations lead to a more significant performance drop for all detectors (line 247-255). However, under these conditions, our method still achieves better average performance compared to other detectors (Fig. 5). We will include examples under these perturbations in the appendix in our revised manuscript to provide readers with an intuitive understanding.\n\n>**Q2: Key details for reproducibility are missing, such as hyperparameter tuning and exact prompts for \"New Generator\" images.**\n\n**A2**: Thanks for your careful review. In fact, as a zero-shot method, our approach requires less hyperparameter tuning. We have conducted supplementary experiments with different diffusion models (refer to the Response 2 to the Reviewer SMhx), sampling steps and specific layers of CLIP (refer to the Response 5 to the Reviewer RcDX). We will include them in our revised manuscript.\n\nRegarding the exact prompts for the \"New Generator\" images, we use the same captions as those of the real images to generate the corresponding fake images(line 196-198), thereby avoiding the introduction of semantic bias. In addition, we have also presented some sample pairs in Appendix A.2 to provide an intuitive comparison."}, {"review_id": "tBZZHORzFi", "reviewer": "Reviewer_RcDX", "summary": "This paper proposes a zero-shot method for detecting AI-generated images based on denoising trajectory analysis over time. The key idea is based on an observation that denoising outputs of AI-generated images converge to target images faster than those of real images. Based on this observation, the authors measure a similarity between the original image and intermediate outputs along the denoising trajectory as an indicator for image authenticity. The method focuses on the image generation process rather than by detecting any artifacts (artificialness) in an image. The method uses DDIM inversion to simulate the sampling process and uses CLIP to extract semantic features for computing similarity. Extensive evaluations are provided to show that this approach generalizes well across diverse generative models and datasets, outperforming both supervised and zero-shot detection methods.", "questions": "1) Can you provide details on computational cost / complexity, and a comparison against other other methods? Also provide details on compute resources (e.g. memory, inference time).\n2) Can you provide more theoretical analysis on why diffusion models predict their generated images more accurately?\n3) Can you compare CLIP features against alternative features such as DINO [a]?\n4) Running 50-step DDIM inversion plus extracting features from all CLIP layers seem expensive. Can you measure the actual computational overhead? Can you yield similar performance with fewer steps or by using only specific CLIP layers?\n5) In Fig6, is the threshold 0.75 for a single dataset or multiple datasets?\n6) In Fig3 the difference between real and AI-generated images on CycleGAN is less obvious as compared to diffusion models. Can you elaborate?\n7) ProGAN is from 2018, have you tried training the supervised methods on more recent datasets? It would be interesting to see how they perform when trained on newer generation models rather than just older GAN data.\n\n[a] Emerging properties in self-supervised vision transformers, ICCV 2021.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1) Interesting observation and a novel idea (the speed of convergence), which is both easy to compute and yet effective. \n2) The method is training-free and applicable to different models.\n3) Extensive validations.\n\nWeakness:\n\n1) Computational costs - compute CLIP features requires loading both CLIP and UNet at every diffusion time step, plus 50 DDIM steps - that's expensive compared to other methods. \n2) Limited theory - the convergence speed observation lacks stronger theoretical analysis beyond KDE. \n3) Feature choice - One can argue what is needed is only image-to-image similarity comparisons. Using CLIP (a Visual-Text cross-modality feature) is more expensive and perhaps unnecessary.  \n4) Robustness - The threshold selection for detection seems ad hoc and raises question about robustness and sensitivity to dataset. In Fig6, is the threshold 0.75 for a single dataset or multiple datasets? If the threshold is sensitive to dataset distribution, that weakens the zero-shot claim.", "was_revised": true, "final_justification": "The authors have clarified most of my concerns and helped to confirm my score. I shall keep my original score.", "rebuttal": ">**Q1: Can you provide details on computational cost /complexity, and a comparison against other methods? Also provide details on compute resources (e.g. memory, inference time).**\n\n**A1**: \nThanks for your insightful review. Here, we primarily compare the computation cost with zero-shot methods, considering that most of them utilize diffusion models. To facilitate the comparison, we report the number of function evaluations (NFE) required to detect one image for each method. The detailed results are as follows:\n\n|         | AEROBALDE | MIBD | ZeroFake | Ours-50steps | Ours-10steps |\n|:-------:|:---------:|:----:|:--------:|:------------:|:------------:|\n|  NFE    |    <1     |  8   |   1019   |      50      |      10      |\n|  AP     |   73.5    | 73.9 |   65.5   |     97.5     |     97.1     |\n\nAEROBLADE performs a single VAE reconstruction, which is less time-consuming than one diffusion model evaluation. MIBD by default uses 8 noise samples per image, while ZeroFake performs a full 999-step forward noising and a 20-step reverse denoising process. We also include the results of our method using a 10-step DDIM inversion, as we found it can achieve similar performance (refer to the Response 5).\nIn our tests, a single function evaluation using SD v1.5 on an A100 GPU takes approximately 0.14 seconds and consumes around 8.5 GB of memory.\n\nAdditionally, the computational cost of supervised methods is significantly lower than that of zero-shot methods, as most of them rely on lightweight network architectures. One exception is SIDA, which uses the large-scale multimodal model, LLaVA[8], for detection.\n\n>**Q2:  Can you provide more theoretical analysis on why diffusion models predict their generated images more accurately?**\n\n**A2**: Thanks for your valuable review. Although diffusion models are capable of generating realistic images, there still exist distributional differences between generated and real images[1,2]. Here, we provide further analysis from the perspective of score matching.\n\nDiffusion models learn the gradient of the log-probability of the data distribution, known as the score function. This score indicates the direction from any given point toward the region of high data density. Generated images lie within the high density region learned by the model, while real images are located in lower density regions[3]. During the denoising process, the model's estimated scores tend to point toward the high-density region, i.e., the region where generated images reside. As a result, diffusion models make more accurate predictions for generated images.\n\n>**Q3: Feature choice, one cna argue what is needed is only image-to-image similarity comparisons. Using CLIP is more expensive and perhaps unnecessary.**\n\n**A3**: Thanks for your insightful review. Image-to-image comparison metrics such as MSE are highly sensitive to changes in the image. For example, altering the contrast of an image can result in a large MSE, even though the two images share the same semantic content. This pixel-level comparison is therefore not suitable for our method. Moreover, we observed similar settings in related works[3,4,5].\n\n>**Q4: Can you compare CLIP features against alternative features such as DINO ?**\n\n**A4**: Thanks for your constructive review. We conducted experiments by replacing CLIP with DINOv2, and the results are as follows (measured in AP):\n\n|           | ForenSynths | GenImage | New Generator |  AVG  |\n|:---------:|:-----------:|:--------:|:--------------:|:-----:|\n|   CLIP    |    97.4     |  97.3    |     97.8       |  97.5  |\n|  DINOv2   |    56.9     |  63.9    |     71.5       |  63.7  | \n\nAs shown, the detection performance using DINO is significantly lower than that of CLIP. We speculate that this difference is mainly due to two reasons. First, unlike CLIP, DINO’s class token does not explicitly model global semantics using image captions. In addition, due to its self-supervised learning approach, DINO learns more robust representations. We observed that it is less sensitive to changes in image details. Meanwhile, we found that Rigid[4] also pointed out the significant impact of using CLIP versus DINO on detection performance.\n\n>**Q5: Can you yield similar performance with fewer steps or by using only specific CLIP layers?**\n\n**A5**: Thanks for your inspiring review. In our paper, we used 50-step DDIM inversion—a default setting—and simply averaged the similarity scores of class embeddings extracted from all layers of CLIP as the final metric. Here, we conduct experiments using fewer DDIM inversion steps and specific CLIP layers, and find that our method can achieve similar performance. The detailed results are as follows (measured in AP):\n\n|           | ForenSynths | GenImage | New Generator |  AVG  |\n|:---------:|:-----------:|:--------:|:--------------:|:-----:|\n| 10-step   |    97.5     |  96.9    |     97.0       | 97.1  |\n| 20-step   |    97.8     |  96.8    |     97.4       | 97.3  |\n| 50-step   |    97.4     |  97.3    |     97.8       | 97.5  |\n\n| layer1 | layer4 | layer7 | layer10 | layer13 | layer16 | layer19 | layer22 | layer24 |\n|:------:|:------:|:------:|:-------:|:-------:|:-------:|:-------:|:-------:|:-------:|\n|  57.8  |  62.3  |  86.3  |  92.9   |  97.8   |  97.6   |  92.8   |  85.4   |  82.4   |\n\nUsing only 10 DDIM inversion steps causes almost no degradation in our method's performance. Employing specific intermediate layers of CLIP can even bring slight improvements in detection performance(e.g., layer13). Moreover, the variation in detection performance across different layers is closely correlated with the curves presented in Fig4. These results are valuable, and we will include these results in the revised version to make our ablation study more complete.\n\n>**Q6: The threshold selection for detection seems ad hoc and raises question about robustness and sensitivity to dataset. In Fig6, is the threshold 0.75 for a single dataset or multiple datasets?**\n\n**A6**: Thanks for your review. The threshold 0.75 is applied across all datasets (line 264-266). \n\n>**Q7: In Fig3 the difference between real and AI-generated images on CycleGAN is less obvious as compared to diffusion models. Can you elaborate?**\n\n**A7**: Thanks for your careful review. The real images in the CycleGAN dataset differ in resolution from those in the SD1.5 and Glide datasets, being 256x256 compared to the latter two, which are around 512 in both height and width. We speculate that this resolution difference may be the main source of the observed discrepancies. However, even under this condition, the real images in CycleGAN still pass through the nonlinear stage more slowly, which may explain why our method continues to achieve promising detection performance on this dataset.\n\n**Q8: ProGAN is from 2018, have you tried training the supervised methods on more recent datasets? It would be interesting to see how they perform when trained on newer generation models rather than just older GAN data.**\n\n**A8**: Thanks for your careful review. Training on ProGAN is a commonly adopted setting in related works[6,7]. According to your advice, we further trained NPR and UnivFD on the StyleGAN2 and SDv1.5 image datasets, respectively, considering they achieve the best performance among the two types of supervised methods. The experimental results (measured in AP) are as follows:\n\n| Method              | ForenSynths | GenImage | New Generator |  AVG  |\n|:-------------------:|:-----------:|:--------:|:--------------:|:-----:|\n| NPR-StyleGAN2       |     90.0      |   73.0     |     73.5       | 78.8  |\n| NPR-SDv1.5          |    77.7     |  88.7    |     92.6       | 86.1  |\n| UnivFD-StyleGAN2    |    95.2     |  80.3    |     70.5       | 82.4  |\n| UnivFD-SDv1.5       |    60.9     |  88.9    |     96.1       | 81.6  |\n\nAs shown, training on StyleGAN2 yields results similar to those obtained on ProGAN, with NPR even achieving lower detection performance. In addition, detectors trained on a specific generator tend to perform well under the cross-architecture setting, but they struggle to effectively detect images generated by cross-paradigm generators.\n\n\n[1] Wang, et al. DIRE for Diffusion-Generated Image Detection. ICCV 2023\n\n[2] Chu, et al. FIRE: Robust Detection of Diffusion-Generated Images via Frequency-Guided Reconstruction Error, CVPR 2025.\n\n[3] Jonathan Brokman, et al. Manifold Induced Biases for Zero-shot and Few-shot Detection of Generated Images. ICLR 2025.\n\n[4] He, et al. Rigid: A training-free and model-agnostic framework for robust ai-generated image detection. arXiv preprint arXiv:2405.20112, 2024.\n\n[5] Sha, et al. Zerofake: Zero-shot detection of 445 fake images generated and edited by text-to-image generation models, CCS 2024.\n\n[6] Tan, et al. Rethinking the upsampling operations in cnn-based generative network for generalizable deepfake detection, CVPR 2024.\n\n[7] Ojha, et al. Towards universal fake image detectors that generalize across generative models, CVPR 2023.\n\n[8] Liu, et al. Visual Instruction Tuning, NeurIPS 2023."}]

Author rebuttal:

Meta-review: This paper proposes a novel AI-generated image detection algorithm based on the observation that real and fake images behave differently under DDIM inversion. Reviewers acknowledged the originality of this insight and appreciated the broad evaluation and strong empirical results.

In the initial reviews, several concerns were raised regarding the clarity and writing quality, efficiency limitations, lack of theoretical or rigorous explanation, evidence of design choices and dependencies, and incomplete coverage of related zero-shot methods and references. During the rebuttal and discussion, the authors clarified methodological details, added explanations, conducted additional ablations (e.g., different diffusion models, DDIM steps, CLIP vs. DINO features), and provided further quantitative results.

Most concerns were satisfactorily addressed, and the reviewers maintained positive ratings (three borderline accepts and one accept). Therefore, the paper is recommended for acceptance. The authors should ensure that the final version is revised to follow the suggestions from reviewers.
Decision: Accept (poster)