Training-free Detection of AI-generated images via Cropping Robustness
Authors: Sungik Choi
Hankook Lee
Moontae Lee
Venue: NeurIPS 2025 poster ()
Keywords: AI-generated image detection
Training-free
self-supervised model
RandomResizedCrop
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: Self-supervised models learn robust representation of real images under cropping and resizing, which can be  applied to detect AI-generated images without training.

Abstract: AI-generated image detection has become crucial with the rapid advancement of vision-generative models. Instead of training detectors tailored to specific datasets, we study a training-free approach leveraging self-supervised models without requiring prior data knowledge. These models, pre-trained with augmentations like $\texttt{RandomResizedCrop}$, learn to produce consistent representations across varying resolutions. Motivated by this, we propose $\textbf{WaRPAD},$ a training-free AI-generated image detection algorithm based on self-supervised models. Since neighborhood pixel differences in images are highly sensitive to resizing operations, WaRPAD first defines a base score function that quantifies the sensitivity of image embeddings to perturbations along high-frequency directions extracted via Haar wavelet decomposition. To simulate robustness against cropping augmentation, we rescale each image to a multiple of the model’s input size, divide it into smaller patches, and compute the base score for each patch. The final detection score is then obtained by averaging the scores across all patches. We validate WaRPAD on real datasets of diverse resolutions and domains, and images generated by 23 different generative models. Our method consistently achieves competitive performance and demonstrates strong robustness to test-time corruptions. Furthermore, as invariance to $\texttt{RandomResizedCrop}$ is a common training scheme across self-supervised models, we show that WaRPAD is applicable across self-supervised models.

Training-free Detection of Al-generated images via Cropping Robustness
Sungik Choi Hankook Lee² LG AI Research "SungkyunKwan University
Moontae Lee University of Illinois Chicago
sungik. cwwihhhoeeeeeeeee choi@lgresearch.cc ai
Abstract
Al-generated image detection has become crucial with the rapid advancement vision-genete generative models. Instead of training detectors tailored to specific datasets, we study training-free approach leveraging self-supervised models without re- quiring prior data knowledge. These models, pre-trained with augmentations like RandomResizedCrop. learn to produce consistent representations across varying resolutions. Motivated by this, we propose WaRPAD, a training- free Al- Al-generated image detection algorithm based on self-supervised models. Since neighborhood pixel differences in images are highly sensitive resizing operations. WaRPAD first defines a base score function that quantifies the sensitivity of image embed- dings to perturbations along high- greefrreyency directions extracted via Haar wavelet decompasition. To simulate robustness against cropping augmentation, we rescale each image to a multiple of the model's ' input size, divide into smaller patches, and compute the base score for each patch. The final detection score is then ob- tained by averaging the scores across all patches. We validate WaRPAD on real datasets of diverse resolutions and domains, and images generated by 23 different generative models. Our method consistently achieves competitive performance and demonstrates strong robustness test-time corruptions. Furthermore, invari- ance to RandomResizedCroop is a common training scheme across self-supervised models, show that WaRPAD is applicable across self-supervised models.
Introduction
Al-generated image detection aims to design reliable metrics that can distinguish between real and synthetically generated images. This task has become increasingly critical with the advent of highly capable text-to-image (T2I) generative models that can produce photorealistic outputs, which may be exploited for vicious purposes (e.g., fake news [1], deepfakes [2]). Most existing detection approaches [3, 4] are trained to recognize specific real data distributions (e.g., ImageNet [5]. LSUN [6]). However, the scope real image distributions that current detection approaches can effectively cover remains extremely limited compared to the diversity of generated images. Furthermore, training dataset for detection may contain artifacts (e.g.. WebP compression in LSUN), which may lead the detector to overfit the artifacts and may fail be robust in rest-time corruptions [7]. Consequently, there is a growing need for detection methods that can operate universally across diverse domains without relying on the constraints of predefined real image distributions.
response to this growing demand, this paper focuses on training-free detection methods where no prior knowledge of real image distributions is given. Prior training-free detection methods have design score functions based on representations extracted from large-scale pre- trained foundation models. One representative line of work leverages the representation of latent diffusion models (LDMs) (e.g., Stable Diffusion [8], Midjourney [9]). For instance, AEROBLADE [10] detects LDM -Dgerrneetted images by measuring the autoencoder reconstruction loss, while Manifold Bias [11] proposes
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Wavelet-based Porturbation
(os(:))
Real Al?
Rescale
frs
Average Similarity
Patchify
SelF Self-supervised Model
Figure 1: Conceptual illustration of our method WaRPAD. We first rescale and patchify the given
image to the batch of patches. Then, we perturb the patches on the high-frequency direction of Haar wavelet decomposition. Our final score function is the averaged cosine similarity between the perturbed and non-perturbed patches' features through the self-supervised model.
curvature-based metric in the latent space of the LDM. However, the performance of these approaches is often tied closely to the choices of the LDMs, and their generalizability to other generative models remains uncertain.
Another stream of training-free free research utilizes representations from self-superrvsed models, such as DINOv2 [12]. These models benefit from pre-training on wide range of real-world images and often applied as generalist models for various downstream tasks [13, 14]. Some prior works [15, 16] attempt utilize self-supervised models Al-generated image detection by introducing simple perturbations (e.g.. Gaussian noise or Gaussian blurring) and measure the cosine similarity between the original and perturbed image embeddings. However, their performance often lags behind the diffusion-based training-free baselines (see Section 4.2).
Contribution. In this study, we approach Al Al-generated image detection from data augmentation perspective, utilizing foundation models that have been pre-trained on real images. Our primary motivation stems from the observation that these models are trained to produce consistent embedding representations between an original image and its randomly cropped and resized variants. We hypothe- size that embeddings of Al-generated images exhibit lower robustness to such RandomResizedCroo, (RRC) transformations than those of real images.
To investigate this hypothesis, examine how RRC affects the high-frequency components of images, as obtained through wavelet decomposition. Notably, we observe that even when the cropped image closely matches the original in size, RRC introduces substantial variations in the difference in the neighborhood pixels. This indicates that RRC acts as an effective perturbation on the high- frequency components extracted via Haar wavelet decomposition. Given that foundation models are typically trained to be invariant to such perturbations on the real images, we propose a detection score function that quantifies embedding sensitivity to high- high-frequency distortions as signal for distinguishing real and synthetic images.
Furthermore, to simulate the effects of RRC in a more structured and deterministic manner, we resize each image to a multiple (x (xK²) of the default input resolution and partition it into K2 patches of the default resolution. We then apply the proposed score function to each patch and aggregate the results. This patch-based perturbation consistently reveals a greater discrepancy in Al-generated images, demonstrating the effectiveness of our method. Figure shows the computation of our unified method, WaRPAD: Wavelet, Resizing, and Patchifying for Al-generated image Detection.
We conduct extensive evaluations of WaRPAD across multiple Al-generated image detection bench- marks. These benchmarks span various generative model types, including LDMs, proprietary models (e.g., Firefly [17], Dall-E [18]), and generative adversarial network (GAN) [19] architectures, as well as multiple image domains. Our method consistently outperforms other training-fre baselines in all settings. Notably, we observe improvement of 6.5 ~ 24.7% in AUROC over prior methods based on the same DINOv2 model. Furthermore, we evaluate the robustness our method against various image corruptions and show that it maintains competitive performance under such conditions, surpassing other detection methods.
In brief. our contributions are summarized as follows.
We propose WaRPAD that applies a self-supervised foundation model's robustness on RRC augmentation for detecting Al-generated images (Section 3).

---

WaRPAD outperforms existing training-free free Al-generated image detection methods in every benchmark consistently (Section 4.2). Furthermore, WaRPAD is robust to test-time corruption of the examined images (Section 4.3).
Our analysis suggests that self-supervised model trained to be invariant under RRC can be ap- plied for Al-generated image detection, supporting the generalizability of WaRPAD (Section 4.3).
2 Preliminary
First, we introduce the Al-generated image detection framework. Furthermore, we discuss the self-supervised models and their key data augmentation strategy. For the broader overview, we refer to Deng et al. [20] and Uelwer al. [21] for the comprehensive survey.
2.1 AI Al-generated Image Detection
AI Al-generated image detection aims design a scoring function S(x) that determines whether given image x has been acquired from the real world (i.e..((x)) 2 T) or generated by generative model (i.e., S(x) 7). While most existing approaches train S(x) using labeled datasets containing both real and synthetic images, we assume more practical setting in which such training data is not available. This setup allows to assess the generalizability of detection methods to previously unseen data distributions.
Recently, this generalizability to unseen distributions has been discussed in training-based approaches as well. ZED [3] proposes an entropy-based score that can be trained solely on real image distributions without requiring any synthetic examples. Cozzolino et al. [22] train Linear SVM classifier on CLIP [23] embeddings extracted from image pairs (e.g.. MS-COCO [24] and LDM- D0M-generated [8]) and evaluate its performance on unseen images (e.g.. Raise- 1K [25] and Firefly [17]). Rajan and
Lee [7] improve robustness to post-processed images by retraining the final layer of the pre-trained detection model. Extending beyond these approaches, we focus on training -free detection setting in
which no real or fake data is provided during the design of the detection score.
Training-fis frreeing-free free detection aims to construct universal score based the outputs of pre-trained foundation model. Such a foundation model may either be a generative model itself (e.g.. LDM [8]) or model trained diverse real-world images (e.g., DINOv2 [12], CLIP [23]). In this work, adopt the latter approach, leveraging models pre-trained on real data to guide our detection framework.
2.2 Self-supervised Models
Self-supervised models aim to learn robust representations from large-scale unannotated images that can be generalized to a wide range of downstream tasks. Self-supervised learning methods apply various augmentations, often referred to as views, to a single image and train the model to maximize the similarity between outputs corresponding to differrntt views. This paradigm has been implemented in various forms, including contrastive learning (e.g., SimCLR [26], Moco [27]). clustering based (e.g., SwaV [28]), and knowledge distillation (e.g., DINO [29]). Since providing comprehensive overview of self-supervised learning (SSL) is beyond the scope this paper, we focus on the DINOv2 [12] model and the augmentation strategies.
DINOv2 is Vision Transformer [30] model trained on a web-scale LVD-142M dataset, building upon the iBOT [31] framework. DINOv2 tokenizes each input image and outputs patch-level embeddings along a [CLS] token embedding that summarizes the entire image. The model is trained using teacher-student framework, where the student network is optimized to maximize the similarity between its output and the output of the teacher network given relatively mild augmentations. The teacher network is updated via an exponential moving average of the student parameters.
core component of the data augmentation applied to both networks RandomResi izedrrppppeeerrppppp (RRC), which randomly crops the region from the input image and resizes it to the given resolution. This operation enforces spatial invariance by encouraging the model recognize that different subregions of an image correspond to the same underlying semantic content. Due to its effectiveness, RRC has become a standard augmentation technique across many SSL frameworks. this work, we adopt RRC as the key motivation for designing our Al- Al-generated image detection method.

---

(a)
(b)
Figure 2: Motivation for the Haar-wavelel perturbation sensitivity score. (a): The original image along with the designated region for high-frequency visualization, marked red. To simulate the effect of RandomResizedOrop (RRC), apply cropping regions indicated in green, blue, and yellow. (b): The wavelet decomposition. (c), (d), (e): The corresponding high-frequency components of the RRC- transformed images, where the cropping regions are defined by the green, blue, and yellow boxes, respectively.
component of the original (uncropped) image obtained via Haar
3
Method
This section introduces our method, WaRPAD, inspired by the RandomResizedCrop (RRC) opera- tion. We first propose score function that measures the sensitivity of self-supervised model features to perturbations along high-frequency directions induced by wavelet decomposition (Section 3. 1) Subsequently, we simulate local robustness by introducing a rescaling-and-patchaee and-patching paradigm that partitions resized images into subregions for evaluation (Section 3.2).
3.1 Base Detection Score
We hypothesize that measuring image's 's robustness to RRC detecting Al-generated images. However, RRC involves random cropping over a broad hyperparame- ter space, which introduces variance and may discard key image content of the original image. To address this, we do not apply RRC directly but instead propose a score function that approximates its effect. Specifically, we examine how RRC alters the high-frequency components of the image using wavelet decomposition, motivated by the previous works that Al-generated images exhibit different high-frequency information [32, 33].
an effective score for
For the analysis, we visualize the high-frequency components obtained via Haar wavelet decomposi- tion under multiple instances of RRC, illustrated in Figure 2a. Figure 2b presents the high-ffreueecy component within the red-marked region of the original image, whereas Figures 2c, 2d, and 2e show the corresponding components after applying RRC with green, blue, and yellow cropping regions, re- spectively. These comparisons reveal that RRC introduces substantial variations in the high-free frequency components, even when the cropped region closely matches the original image in size. Based this observation, we define our base score function as the model's ''s sensitivity to perturbations along the tigh-frequency directions, formally expressed as follows:
HFwav(x) (x) fM oHF(x))
(1)
(xx
fM (x aHF(x))]l
where fxr denotes the feature output of the self superviedd model M (e.g., the [CLS] token output of DINOv2), HF represents the geehffreyeyccy component derived from wavelet decomposition, and 0 < a < is the perturbation weight. The sensitivity score function HFwav quantifies the change of model M perturbations along high-frequency directions. Our central hypothesis is that model M, having been trained on real images, encouraged to be invariant to such high-frequency perturbations. Accordingly, we expect the wav score be higher for real images than the Al-generated images.
3.2 WaRPAD
We further propose a test-time augmentation strategy inspired by RRC. Our main idea to determin- istically simulate multiple instances of RRC by explicitly rescaling the image and thereby patchifying

---

200
8Dv1.4
SDv1.4
SDv1.4
130
2000
60
1000
0.000
0.282
0.034
0.508
0.908
1.000
0
0.580
0.985
0.000
0.085
1.000
0,0850 0.987S 0,9000 0.9225 0.0683 0.9975 1.0200
Base
Patch
Average
(a)
(b)
(c)
Figure 3: Effect of oessaalelPatchifff (a): Histogram of real and SDv..4-geeee 44-generated data examined by HFwav. (b): Histogram of real and SDv ---genrrteedd data examined on patches augmented by RescaleNPatchifg (c): Histogram of real and SDv1.4 4-generated data examined on our WaRPAD
score function.
Table 1: Benchmarks in the main experiment.
Benchmark
Real Dutaset
of Generative Models
Input Resolution
of Test Images Dataset
Syuthbuster [34]
Raise-
9 (LDM, Proprictary Model)
Verying 256 4928 3264) Varying
1000
Genlmage [35]
ImageNet LSUN [6]
Diffasion Model, LDM)
1024)
Deepfake LSUN Bedroom [36]
10 (GAN, Diffusion Model)
256 250
10000
the image to patches with the same sizes as follows:
RescaleNPatchhffyx) = Patchify (Rescale(x, drewale). dputch):
where diescale and dpanch are the dimension of the rescaled image and the dimension the patch, Rescale(x xx d) is the image rescaling operation to dimension d x d, and Patchify(x,, d) is the image patchifying operation to patch dimension d x d, respectively.
(oeas ) number of patches with dpacc x dpatch The RescaleMPatchity operation results in Ryatchh dgna,
dimension. We now examine the proposed sensitivity score Section 3.1 and average the sensitivity score to output the unified score function as follows:
WaRPAD(x))
Σ
(XpaicXXp
Tpptch Xpac ERescalllPatcchsttll
Our proposed WaRPAD examines the sensitivity score in the resized subregion of the images, which multiple instances of RRC with the area of nyanh resized to dimension of dpatc dpatch- Since the model is trained be invariant under various RRC instances that include crops similar the patch, we expect the base score HFwav evaluated on the patch to be still robust. On the other hand, We hypothesize the model output of the Al Al-generated image will deviate in the patches, hence our WaRPAD further improves on detecting Al Al-generated images. We verify our hypothesis by examining WaRPAD and our base score 1000 real RAISE-IK [25] data and 1000 SDv 14-generated data in the Synthbuster benchmark [34]. We select drescale 1344 and dyncch 224.
We show the histogram of real and Al-generated images under base score the image, base score on the patch, and the averaged WaRPAD score in Figure 3a, 3b, and 3c, respectively. Al-generated images lose their robustness our wavelet-based sighffrequency perturbation when examined in patches generally. The discrimination between Al-generated images and real images is strengthened our final score induced by averaging the score function across patches.
4 Experiment
We now evaluate WaRPAD's efficacy on Al-generated image detection. We first introduce the benchmarks and generative models for each benchmark well the baseline methods (Section 4.1). We report the performance of WaRPAD across these benchmarks (Section 4.2). Finally, we present detailed ablation studies of WaRPAD and test its robustness in corruptions (Section 4.3).
4.1 Experiment Settings
Datasets. We first test WaRPAD Synthbuster [34] benchmark based on RAISE-IK dataset [25] where generative models applied: Firefly [17], GLIDE [38], SDXL [39], SDv2, SDv1.3, S.v1.4
5

---

Table 2: Al-generated image detection performance (AUROC) of WaRPAD and baselines in the Synthbuster [34] benchmark, Bold and underline denotes the best method and the second best methods, respectively.
Method
Firefly
GLIDE
SDXI.
SDv1.3
SDv1.
DALLEE3
DALLER2
Midjourney
Training-bused Methods
AIDE [4]
0.165
0.780
0.835
0.642
0.946
0.933
0.415
0.426
0.688 0.374
0.648
FatForeer [37]
0.586
0.718
0.707
0.513
0.486
0,500
0.186
0.571
0.516
Training- free Methods
RIGID [15]
0.868
0.757
0.442
0.593
0.587
MINDER [16]
0.440
0.568
0.472
0.721
0.656
0.668
0.346
0.445
0.345
0.518
AEROBI ADE [10]
0.592
0.954
0.668
0.567
0.950
0.950
0.486
0.392
0.769
0.703
Manifold Bias [11]
0.493
0.779
0.562
0.749
0,544
0.549
0.379
0.607
0.424
0.565
WaRPAD (ours)
0.927
0.999
0.830
0.775
0.959
0,958
0.422
0.930
0.702
0.834
Table 3: AI Al-generated image detection performance (AUROC) of WaRPAD and baselines in the GenImage [35] benchmark. Bold and underline denotes the best and second best methods, respectively.
Method
ADM
BigGAN
GLIDE
Midjournyy
SDv1.4
SDv1.5
VQDM
Wukong
Mcan
Training- Training-bused Methods
AIDE [4]
0,921
0,920
0.987
0.959
1.000
1.000
0.965
1.000
0.969
FatFormer [37]
0.903
0.995
0.951
0.579
0.780
0.776
0.967
0.824
0.847
Training- free Methods
RIGID [15]
0.874
0.974
0.952
0.778
0.682
0.682
0.915
0.699
0.820
MINDER [16]
0.768
0.681
0.582
0.450
0.607
0.596
0.882
0.676
0.655
AEROBLADE [10]
0.856
0.981
0,989
0,918
0,982
0.984
0.732
0,983
0.928
Manifold Bias [II]
0.727
0.925
0.852
0,510
0.675
0.673
0.874
0.653
0.736
WaRPAD (ours)
0.986
0.998
0.991
0.810
0.940
0.936
0.981
0.924
0.946
Table 4: Al-generated image detection performance (AUROC) of WaRPAD and baselines in the
Deepfake-LSUTI Suaie-LLLUU--BBrooo [36] benchmark. Bold and underline denotes the best method and the second best methods, respectively.
ADM
DDPM
DifiPPojostiIAAN
IDDPM
PNDM
ProGAN
PrejecteKiAN
StylGAN
Training based Methods
AIDI [4]
0.636
0.722
0.840
0:951
0.679
0.807
0.941
0.890
0.100
0.840
0.825
Fatlormer (37)
0.745
0.709
0.998
1,000
0,824
0.954
0.999
1,000
0.999
0.968
0.921
Training free Methods
RIGID [15]
0.742
0.887
0.917
0.914
0.855
0.846
0.843
0.957
0.944
0.681
0.861
MINDER [16]
0.706
0.796
0.973
0.942
0.782
0.844
0.895
0.970
0.805
0.869
ABROBLA
0.545
0.741
0.488
0.534
0.656
0.254
0.342
0.522
Manifold
0.905
0.920
WaRFAD (ours)
0.7885
0.937
0.988
0.908
[8], DALL-E 3 [40], DALL-E 2 [18], and Midjourney [9]. We also test WaRPAD in GenImage [35]
benchmark where the real data is from the ImageNet [5] dataset and 8 generative models are applied
for fake image generation: ADM [41], BigGAN [42], GLIDE, Midjourney, SDv1.4. SDv1.5, VQDM [43], and Wukong [44]. Finally, we test on the deepfake-LSUN-beed -ue-boooo benchmark [36] containing 10 generative models: ADM, DDPM [45]. Diff- Prff-ProoecteGGANN Diff-StyleGAN2 [46], IDDPM [47],
LDM [8], PNDM [48], ProGAN [49], ProjectedGAN [50], and StyleGAN [51]. We summarize the main information of these benchmarks in Table
Baselines. We consistently compare against available training-free baselines. AEROBLADE [10]
and Manifold Induced Bias [11] apply SD for the examination. Consistent with the proposal of
Brokman et al. [11], we apply SDv1.4 for the inspection model. We also compare against RIGID [15] and MINDER [16], which apply DINOv2 for Al-generated image detection. We follow the original hyperparameter settings from the paper. To further examine the efficacy of training-free setting, we also compare with the leading training-based methods [4, 37] for comparison. Specifically, we examine the pre-trained checkpoint of each method in each benchmark without further training. Note that AIDE is trained on real ImageNet data and SDv 4--genrrttedd data, while FatFormer trained on LSUN data and ProGAN-generaal data.

---

Real-Genlmagee
(b) Al-GenImage
Real-L-SUN
AI-L.SUN
Figure 4: Visualization of the HFwav score across patches. We show the patch with the highest score in red and lowest score blue. Each image is from ImageNet (a), ADM-generated GenImage (b), LSUN (c), and ADM-generated Bieiaak-LLSN--Berde dataset (d), respectively.
Implementation Details. The performance of all methods is reported by the area under the ROC curve (AUROC), Consistent with RIGID and MINDER, base model. We use the Haar wavelet with 2-level decomposition to extract the high-frequeen information. We also set death and a to 224 and 0.1 throughout all experiments. For the rescaling dimension dreseale, we set 896 for the GenImage and Decpfake-LSUN-beet 1344 for the Synthbuster benchmark. We implement our code in the Pytorch [52] framework. All experiments are done on single A100 GPU.
the DINO-ViT-LI4 model as the
benchmark and
4.2 Main Results
Tables 2, 3, and 4 report the performance of WaRPAD compared to other training-free approaches in Synthbuster, Genlmage, and Deepfake-I.SUN- bedroom benchmark, respectively. WaRPAD achieves the best performance all benchmarks average. Notably, WaRPAD consistently outperforms RIGID and MINDER by a wide margin of over 6% AUROC.
On the other hand, diffusion-modell-aaee bassd methods fail to show consistent performance compared WaRPAD, For example, while AEROBLADE is competitive WaRPAD in the GenImage benchmark, where some generative models share the same autoencoder with the inspected SDv model (e.g.. SDv1.5, Wukong), its performance deteriorates on detecting proprietary models (e.g., Firefly, DALL-E 2) or GAN-basee based models. On the other hand, Brokman et al. [1 1] can efficiently perform in the Deepfake-LSt LSUN--SUU---EE--- benchmark but fails on the Genlmage and Synthbusters benchmarks.
Finally, training-based methods fail generalize unobserved real data distribution and underper- form over our WaRPAD. Specifically, while AIDE performs well on detecting SDD-generated data in the GenImage benchmark, it underperforms on other generative models and Deepfake-LSUN- Bedroom/ Synthbuster benchmarks. A similar phenomenon occurs in FatFormer, which shows underwhelming performance in Genlmage/Synthbustee benchmarks. On the other hand, WaRPAD shows the best performance in general, even improving over the FatFormer in LSUN- based bench- mark.
We also visualize the pise score information the real and Al-generated images. Figure shows the patch with the highest HFwav score (denoted red) and the patch with the lowest score (denoted as blue) in the real and Al-generated data in GenImage and Deepfake-LSti Lee---SUN---oooo benchmark, respectively. While HFwav assigns high scores patches with rich texture information, the region does not always align with the semantics of the image (e.g., Figure 4c).
4.3 Analysis
We formulate our analysis to validate the following questions:
Does each component of WaRPAD contribute to consistent performance gains?
WaRPAD robust design choices, hyperparameter ablation, and test-time perturbations?
Is WaRPAD effective for other domains?
7

---

Table 5: Ablation Study on each component of WaRPAD. We report AUROC. Gains are computed
against RIGID [15].
Method
Synthbuster
Genlmage
Deepfake LwLL--SUU--BEEe
RIGID [15]
0.587
0,820
0.861
RIGID X71pasch
0,589 (+0.2%)
0.823 (+0.3%)
0.872 (+1.1%)
HFwav
0.636 (+4.99%)
0.809 (-1.1%) 16)
0.890 (+2.9%
RIGID RescalelfPatchify
0.656 (+6.9%
0,800 (-2.0%)
0.861 (+0.0%)
WaRPAD
0.834 (+24.7%)
0.946 (+1..6%)
0.934 (+7.3%)
AUROC
3.8
AUROC
07
2.7
07
0.5
Gevinnge
Syttibuttrr
06
0.55
0.1
02
95
112
224
446
4pash
(a)
(b)
(c)
Figure Hyperparameter analysis WaRPAD (a): AUROC performance of WaRPAD with respect to in the Synthbuster benchmark. (b): AUROC result with respect to the drescate- (c): AUROC result with respect to the dnatch in the Synthbuster benchmark.
Effect of each Component. We first analyze the effect of our proposed HFwav and RescaleMPatchiffy operation. We also investigate the synergy of HFwav and RescaleMPatchiffy by experimenting with RIGID [15] with the same RescaleNPatchiff procedure. Further, we experiment with the "path enssmbee version of RIGID that takes the same computational cost as our WaRPAD. We show the results in Table 5 with a comparison against RIGID [15]. Our perturbation- based metric improves over RIGID in two out benchmarks. Moreover, RIGID combined with proposed RescaleNPat chify shows relatively little improvement from RIGID compared to WaRPAD, highlighting the efficacy of both components.
Hyperparameter Analysis. We analyze the effect of the hyperparameters of the WaRPAD indepen- dently. Figure analyzes the effect of perturbation weight in the Synthbuster benchmark. We also analyze the effect of the rescaling dimension drescate on separate benchmarks in Figure 5b. All hyperparameter choices consistently improve over the base dimension, 224. Finally, as DINOv2 can accept arbitrary patch sizes, also test WaRPAD in the different patch dimensions dpanch- We show result Figure 5c where the base choice of 224 performs the best.
Design Choices. We first show the AUROC result of WaRPAD across different aggregation rules of the computed patch-wise metric and the backbone DINOv2 version. For the aggregation rule, test the mean, median, minimum. and maximum across patches. For the backbone model, we experiment with 'ViT-S14', 'VTT-B14', 'VIT-L14', and 'ViT-g14'. We also experiment with the 'VIT-L14' and 'ViT-g14' with register tokens [14].
We show the result in Table 6. Note that Mean and 'VIT-L14' correspond to the results in Section 4.2. In the perspective of the aggregation rule, the mean or median aggregation rule achieves the best performance consistently. On the other hand, concerning the DINOv2 backbone, larger model size shows better results with the slight exception of the VVTT-L14' backbone the GenImage benchmark.
We further experiment with the different choices of the wavelet and the decomposition level of the wavelet decomposition. Apart from the Haar wavelet, we experiment with Daubeches wavelets (db2, db3, db4), Biorthogonal wavelets (biorl.3, 13, biorl.5, bior2.2, bior2.4, bior3.1), and Coiflet wavelets (coifl, coif2, coif3) with decomposition levels from to 3.
We present the results in Table 7, grouping wavelets by the number of vanishing moments in the (synthesis) wavelet function vh. While the Haar wavelet achieves the highest performance, our results indicate that other wavelets with one vanishing moment also perform competitively. In contrast, wavelets with higher vanishing moments tend to induce more structured perturbations on the real images, and we find that DINOv2 is longer robust to the perturbation. We further report this

---

Table 6: Ablation Study on the DINOv2 backbone and patch-wise aggregation rule on WaRPAD.
We report AUROC. Bold denotes the best choice.
Agg Rule
VIT-S14
ViT-B14
ViT-L14
ViT-L14-reg
ViT-g14
ViT-gl4-reg
Mean
4.76/0.66/0.8
0.82/0.92/0.90
0.83/0.95/0.98
0.84/0.94/0.94
0.86/0.94/0.99
0.87/0.94/099
Median
0.77/0.85/0.81
0.83/0.91/0..9
0.84/0.94/0.92
0.85/0.94/0.93
0.85/0.93/0.99 95
0.87/0.94/0.99
Min
0.71/0.85/0.79
0.75/0.89/0.84 84
0.76/0.91/0.
0.77/0.91/0.89
0.80/0,900091
0.80/0, 90/009000090 90
Max
0.68/0.74/0.63
0.77/0.8100.77
0.78/0,90/0.99
0.78/0.9000.76
0.79/0.90/0.87
0.80/0.91/0.87
Table 7: Al-generated image detection performance (AUROC) to wavelet choice and decomposi- tion level in the Synthbuster benchmark. Bold and underline denotes the best and the second best choice. We group the wavelets by the number of vanishing moments on a wavelet function yb.
vanishing moment
> vanishing moments
Level
Haar
bior 1.3
bior 1.5
dh2
dh3
dh4
hior 2.2
bior 2.4
bior 3.1
coifl
coif2
coif3
1
0,745
0.715
0.701
0.458
0.505
0.527
0.474
0.483
0,486
0,480
0.481
0,487
2
0.834
0.591
0.827
0.512
0.491
0.508
0.512
0.487
0,472
0.533
0.506
0.501
3
0.787
0.585
0.569
0.466
0.490
0.460
0.476
0.490
0.486
0.498
0.457
0.467
Table 8: Al-generated image detection performance (AUROC) in the Synthbuster benchmark under different backbones.
Invariant to RRC
Others
Method
DINOv2 [12]
CLIP [23]
SwaV [28]
DINO [29]
BeiT [53]
VITMAE [54]
RIGID
0.587
0.561
0.542
0.480
0.619
0.531
MINDER
0.518
0.583
0.542
0.478
0.473
0.545
WaRPAD 0.834
0.802
0.743
0.707
0.486
0.620
phenomenon in the Appendix, where we include histograms of the score distributions for other wavelets for both real and Al-generated images.
Robustness to Corruptions. Our WaRPAD is based on the self-supervised vision model, which may learn robust representations due to training on a wide range of perturbations (e.g., Color RandomSolarize). Hence, we test WaRPAD's robustness on the corruption of the input images, both real and Al Al-generated. For comparison, we also test RIGID, MINDER, and AEROBLADD on the same corruption. We report the average performance on the GenImage benchmark with JPEG compression, center crop and resizing, and Gaussian noise corruptions with varying degrees.
Figure 6 shows the performance of WaRPAD well the training-free baselines under corruption in the GenImage benchmark. WaRPAD achieves competitive performance over the baseline in every corruption consistently, On the other hand, AEROBLADE's performance quickly degrades compared to WaRPAD in high-level corruption. Experiments in other benchmarks in the Appendix exhibit consistent behaviors.
Extension to other backbones. The result in DINOv2 shows that our proposed metric can perform not only in in-domain datasets (e.g., ImageNet) but also in datasets unobserved in the training phase (e.g., RAISE- 1K, LSUN-Bedroom). We further experiment WaRPAD with other backbones of self- supervised models trained to be invariant under RRC. For the model, and DINO [29]. We also test other models that use RRC only as data augmentation: BeiT [53) and ViTMAE [54]. We also specify the details of the tested models in the Appendix. We further include MINDER and RIGID for each backbone as a comparison. We do not change any hyperparameters.
select CLIP [23], SwaV (28),
As shown in Table 8, our WaRPAD consistently outperforms RIGID and MINDER when the backbone model is trained to be invariant under RRC. However, the gain of WaRPAD is less prominent when tested in the masked-imen iamage-modeling based backbones and even underperforms over RIGID when the backbone model is BeiT.
Examination on other domain data. While we thoroughly evaluate WaRPAD on various bench- marks, such benchmarks are from the natural image domain. Motivated by the recent practice [55] that evaluates Al- Al-generated image detectors outside the natural image domain, further test the

---

JPEG
Crop
Noise
0.9
0.9
0.8
AUROC
0.7
AUROC
0.7
AUROC
0.7
0.6
0.8
WARPAD
0.5
WARPAD
WARPAD
MINDER
MINDER
MINDER
RIGID
RIGID
90
80
70
80
50
0.9
0.8
0.7
0.8
0.5
0.025
0.060
0.075 0.100 0.125
(a) JPEG Compression
(b) Center Crop
(c) Gaussian Noise
Figure 6: Robustness of WaRPAD in corruptions. We test the AUROC performance WaRPAD, AEROBLADE, MINDER, and RIGID in corrupted test images in the Genlmage benchmark.
Table Zero-shot performance of Al-generated image detection methods on the Art domain. We report AUROC.
Method FatFormer [37]
RIGID [15]
MINDER [16]
WaRPAD (ours)
AUROC
0.531
0.725
0.365
0.765
performance of WaRPAD on the Art domain. Since the FakeART benchmark in [55] is not public except for the information that they use the WikiArt dataset for the real data, instead download data from the Kaggle webpage" with 10821/10821 real and Al-generated data available, where the real data is from the WikiArt dataset. For comparison, evaluate method against FatFormer, RIGID, and MINDER on the Art domain, and report the results in Table 9, This demonstrates the effectiveness of WaRPAD under distribution shift.
Conclusion
We propose WaRPAD, an effective training-free Al-generated image detection method motivated by RandomResizedCrree the core data augmentation scheme of self-supervised methods. WaRPAD shows improved performance
robustness against existing training-free methods. The main advantage of the WaRPAD is the ubiquity of the RandomResizeddroop which enables WaRPAD applicable to various self-supervised models as the backbone. Since WaRPAD applies to vision-text trained encoders (e.g., CLIP [23]), our method can be extended to detecting multimodal Al-generated data. We leave this direction to future work.
Broader Impact. WaRPAD offers effective training-free detection of Al Al-generated images in the wild. This provides a tabula rasa defense against the improper use of generative models, including fraud manipulation of Al-generated images. Furthermore, our method can be applied to filter out Al- Al-generated images from the web-scale image data.
procedure induces extra computation costs due to the number of patches, although these patches can be computed in a batch-wise manner. Furthermore, WaRPAD is dependent on the choice of the backbone self-supervised model, and may not generalize to high- resolution real/Al-generated images outside the scope of the backbone model. Finally, when future generative models can succeed in faithfully generating realistic images (including high- frequencgycy components) enough fool the pre-trained foundation model, our approach can be less effective. One promising direction is to utilize recent multimodal foundation models, which may show enhanced understanding of -l-geeerteed images. We leave this direction to future work.
Limitations. Our RescaleMPPatchi
Inctpe://uikiart.on
generated art- art-images dataset Pnttps://ww http://wwwwaaaaooooocccccttctttt aaad--fa--ai--geerateddd
10

---

Acknowledgments and Disclosure of Funding
This work is fully supported by LG AI Research.

---

References
[1] Elizabeth Howcroft. Ai-generated content raises risks of more bank runs, uk study shows.
2025. URL https: httpp::/wwww.ruttrrs.coo rwwters.eeee.eee httpa///s/eeeeeecccoo//o//a/aaaa ai si-generated-com pognerated-content--oe
htwrriicccaittelelgnnnneeee -ot.taal--iiiiieee--dda--oo-aaaa shoo--sssssssssssss-soo-- 2atelooos-222----0 00225-02-144 Accessed: 2025-04-13.
[2] Samantha Murphy Kelly. Hollywood celebrities are being deepfaked into porn. congress con- sidering new law to stop it, March 2025. URL tech/hol
cnn. com 20//2022200/000
wwwgress- -ew.repaaaeee-ooggeeseeaaaaaaaaa html. Accessed: 2025-
04-13.
[3] Davide Coozolino, Giovanni Poggi, Matthias Nießner, and Luisa Verdoliva. Zero-shot detection of ai-generated images. In ECCV, 2024.
[4] Shilin Yan, Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Weidi Xie. A sanity check for ai-generated image detection. In ICLR, 2025.
[5] Jia Deng, Wei Dong. Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, 2009.
[6] LSUN: Construction of a Large-scale Image Dataset using Deep Learning with Humans in the Loop. Understanding and improving training- free ai- ai-generated image detections with vision 2015.
foundation models.
[7] Anirudh Sundara Rajan and Yong Jae Lee. Stay-positive: A case for ignoring real image features in fake image detection, 2025. URL https://arxiv.ott org/ www.oogg////////oooooooooo..ee/t hatpa/abb/22200002 2/////502.0777 07778.
[8] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. In CVPR, 2022.
[9] MidJourney. MidJourney AI Art Generator, 2022. URL htttps:///et mi middiiooueeee com/ home/.
[10] Jonas Ricker, Denis Lukovnikov, and Asja Fischer. Aeroblade: Training-free detection of latent diffusion images using autoencoder reconstruction error. In CVPR, 2024.
[11] Jonathan Brokman, Amit Giloni, Omer Hofman, Roman Vainshtein, Hisashi Kojima, and Guy Gilboa. Manifold induced biases for zero-shot and few-shot detection of generated images. In ICLR, 2025.
[12] Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy V. Vo. Marc Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel HAZIZA, Francisco Massa, Alaaeldin El-Nouby, Mido Assran, Nicolas Ballas, Wojciech Galuba, Russell Howes, Yao Huang, Shang- Wen Li, Ishan Misra, Michael Rabbat, Vasu Sharma, Gabriel Synnaeve, Hu Xu, Herve Jegou, Julien Mairal, Patrick Labatut, Armand Joulin, and Piotr Bojanowski. DINOv2: Leanning robust visual features without supervision. Transactions on Machine Learning Research, 2024. ISSN 2835-8856. https: http://://///eee/eeeeee/e net f
[13] Yang Liu, Chenchen Jing, Hengtao Li, Muzhi Zhu, Hao Chen, Xinlong Wang, and Chunhua Shen. A simple image segmentation framework via in-context examples. In NeurIPS, 2024.
[14] Timothée Darcet, Maxime Oquab, Julien Mairal, and Piotr Bojanowski. Vision transformers need registers. ICLR, 2024.
[15] Zhiyuan He, Pin-Yu Yu Chen, and Tsung-Y Yi Ho. Rigid: A training-free and model-agnostic framework for robust ai-generated image detection. arXiv preprint 12 2024.
[16] Chung-Ting Tsai, Ching Yun Ko, I-Hsin Chung, Yu-Chiang Frank Wang, and Pin-Yu Chen. Understanding and improving training- free ai-generated image detections with vision foundation 2024.
models, arXiv preprint 2rXiv:2411.199
[17] Adobe. Adobe firefly free generative for creatives, 2025. URI. https:t///// / /wwp///ww..//////////o adobe. com/ products/firefi
html. html..
12

---

[18] Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ily Sutskever. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06/155, 2022. URL https:: / aarxivivv org/ hbbs/204006125. 06125.
[19] Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley. Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. NIPS, 2014.
[20] Jingyi Deng, Chenhao Lin, Zhengyu Zhao, Shuai Liu, Qian Wang, and Chao Shen. A survey of defenses against ai- geneertdd visual media: Detection, disruption, and authentication. arXiv preprint arXiv:2407.10575. 2024. URL https: /ttpvv.rxvvvvaaa//////eee//.aav. org org/ abs abs/2407 10575.
[21] Tobias Uelwer, Jan Robine, Stefan Sylvius Wagner, Marc Höftmann, Eric Upschulte, Sebastian Konietzny, Maike Behrendt, and Stefan Harmeling. A survey self-supervised learning: Algorithms, applications, and future trends. JEEE Transactions on Pattern Analysis and Machine Intelligence, 46(12)19052-9071, 2024, doi: 10.1 10.1109/TPAMM..24444111111 URL /ttp:///aa//////////////////////
https: /tttp://www.computer
[22] Davide Cozzolino, Giovanni Poggi, Riccardo Corvi, Matthias Nießnnr, and Luisa Verdoliva. Raising the bar of ai-generated image detection with clip. In CVPR Workshop, 2024.
[23] Alec Radford, Jong Wook Kim, Luke Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In ICMI, 2021.
[24] Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. ECCV, pages 740-755. Springer, 2014.
[25] Duc-Tier Bang-Nguyen, Cecilia Pasquini, Valentina Conotter, and Giulia Boato. Raise: raw images dataset for digital image forensics. In Proceedings of the 6th ACM Multimedia Systems Conference, MMSys '15, page 219-224, New York, NY, USA, 2015. Association for Computing Machinery. ISBN 9781450333511. doi: 11845//771168.27111139 URL httpp://doi..rg 10. 1145/2713168 2713194.
[26] Ting Chen, Simon Korblithh Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In ICML, 2020.
[27] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. CVPR, 2020.
[28] Mathilde Caron, Ishan Misra, Julien Mairal, Priya Goyal, Piotr Bojanowski, and Armand Joulin. Unsupervised learning of visual features by contrasting cluster assignments. In NeurlPS, 2020.
[29] Mathilde Caron, Hugo Touvron, Ishan Mísra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In JCCV, 2021.
[30] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In ICIR, 2021.
[31] Xiuji Zhou, Chen Wei Yang, Chen Change Loy, and Ziwei Liu. ibot: Image bert pre-training with online tokenizer. In ICLR, 2022.
[32] Katja Schwarz, Yiyi Liao, and Andreas Geiger. On the frequency bias of generative models. In NIPS, 2021.
[33] Riccardo Corvi, Davide Cozzolino, Giada Zingarini, Giovanni Poggi, Koki Nagano, and Luisa Verdoliva. On the detection of synthetic images generated by diffusion models. In ICASSP, 2023.
[34] Quentin Bammey. Synthbuster: Towards detection of diffusion model generated images. IEEE Open Journal of Signal Processing, 5:1-9, 2024. doi: 10.1 10.109900SP22003333771,,
13

---

[35] Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang. Genimage: million-scale benchmark for detecting ai-generated image. In NIPS, 2023.
[36] Jonas Ricker, Simon Damm, Thorsten Holz, and Asja Fischer. Towards the detection of diffusion model deepfakes. In VISAPP, 2024.
[37] Huan Liu, Zichang Tan, Chuangchuang Tan, Yunchao Wei, Yao Zhao, and Jingdong Wang. Forgery-awer aware adaptive transformer for generalizable synthetic image detection. In CVPR, 2024.
[38] Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Iyy Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. In ICML. 2022.
[39] Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. In ICLR, 2024.
[40] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Pamela Mishkin, Brooks Chan, Christopher Hesse, Alec Radford, and Ilya Sutskever. Dall-e 3, 2023. URL htw.ttttp//// //cnn. openai. papers/dall-e e- pdf. OpenAl Technical Report.
/ct.ooopa//cd...oaii..... com/
[41] Prafulla Dhariwal and Alex Nichol. Diffusion models beat gans on image synthesis. In NIPS, 2021.
[42] Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale gan training for high fidelity natural image synthesis. arXiv preprini arXiv: 1196, 2018
[43] Shuyang Gu, Dong Chen, Jianmin Bao, Fang Wen, Bo Zhang, Dongdong Chen, Lu Yuan, and Baining Guo. Vector quantized diffusion model for text-to-image synthesis. In CVPR, 2022.
[44] Jiaxi Gu, Xiaojun Meng, Guansong Lu, Lu Hou, Minzhe Niu, Xiaodan Liang, Lewei Yao, Runhui Huang, Wei Zhang, Xin Jiang, Chunjing Xu, and Hang Xu. Wukong: A 100 million large-scale chinese cross-modal pre-trat me--trannnng benchmark. In Advances in Neural Information Processing Systems, Datasets and Benchmarks Track, 2022.
[45] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In NeurlPS, 2020.
[46] Zhendong Wang, Huangjie Zheng, Pengcheng He, Weizhu Chen, and Mingyuan Zhou. Diffu- siongan: Training gans with diffusion. In ICLR, 2023.
[47] Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In ICML, 2021.
[48] Luping Liu, Yi Ren, Zhijie Lin, and Zhou Zhao. Pseudo numerical methods for diffusion models on manifolds. In ICLR, 2022.
[49] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. In ICIR, 2018.
[50] Axel Sauer, Kashyap Chitta, Jens Muller, and Andreas Geiger. Projected gans converge faster. In NeurlPS, 2021.
[51] Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In CVPR, 2019.
[52] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Köpf, Edward Yang. Zach DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, regh-pefformance deep learning library. In NIPS, 2019.
14

---

[53] Hang Bao, Li Dong, Songhao Piao, and Furu Wei. Beit: Bert pre- tre-training of image transformers. In ICLR, 2022.
[54] Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders are scalable vision learners. In CVPR, 2022.
[55] Zexi Jia, Chuanwei Huang, Yeshuang Zhu, Hongyan Fei, Xiaoyue Duan, Zhiqiang Yuan, Ying Deng, Jiapei Zhang, Jinchao Zhang, and Jie Zhou. Secret lies in color: Enhancing ai- ai-generated images detection with color distribution analysis. In CVPR, 2025.
[56] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
15

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: clearly stated the contributions and the scope in the abstract and introduc- tion.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: include the limitation section in the conclusion.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
16

---

Our paper is not based on the theoretical results but on the intuitions for AI Al-generated image detection.
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: we clearly stated our hyperparameter (our algorithm is deterministic) in the experiment section. We followed the author's hyperparameters when reproducing the
baseline.
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, a No answer this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
specific model and empirical evaluation, may
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm.
(b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way access this model for reproducing the results way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing verifying the results.
5. Open access to data and code
17

---

Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [No]
Justification: We will publish the code after the paper gets accepted. However, algorithm is deterministic and the benchmark is public, it would be easy to reproduce the results.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https:
/nips. cctpublic/guii httaa//ggiiiee/oeeeuuuiiiieeeee wwweesubmisiiooPoo.i.
for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question:
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification:
We include all the details on the hyperparameters in the experiment section.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: Our algorithm is deterministic and does not require multiple seeds. While one baseline based on random noise, we also experimented with the ensemble version of this.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoo bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
18

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CL, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We clearly state the resource of A100GPU in the experiment section.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https: /tttup:///eerippe cc/ cttpppiicccccc//cccppppccccccccc csGuidelines!
Answer:
[Yes]
Justification:
We believe that we have faithfully practiced the code of ethics in the guideline.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No. they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the broader impact in the conclusion section.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
19

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied partieular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (c.g., gated release models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of MI).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification:
We do not release any data or model that pose high risk for misuse.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We cite the respective benchmarks for Al-generated image detection. Further- more, we also include the methods that create the dataset and the original datasets. License these datasets are provided in the Appendix.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
20

---

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets. We will publish our code if accepted.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
We do not involve any crowdsourcing research with human subjects.
Guidelines:
The answer NA means that the paper doess not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification:
We do report any result that involves human subject.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
21

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology. scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: Our methodology is not based on any LLMs.
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: /ttp///errpp/////ee cc/Conffreecces/2255 /LLM) for what should or should be described.
22

---

Algorithm WaRPAD (PyTorch-like Pseudo-code)
# fxx): normalized [cls] token output of self-supervised model
# alpha: weight of perturbation
# DifForward, DiTInverse: forward and inverse discrete wavelet transform
# Sim: cosine similarity function
def HFwav (x)
x_low, x_high (WTForward
N. k_perturb DWTInverse ([torch.zeros (xkeosx_lieex_eeeee (xwl x_high]) feat_origgiall fxx)
feat_perturb = f (x alpha N_perturb)
return Sim oin(feat.originai, feat_perturb)
WaRPAD(x)
x_patch RescaleNPatchiff(a)
f_patch HFwav (x_ (x_patch)
f f_patch. (erchh.mea[( ()
A Appendix
A.1 Pseudocode of WarPAD
We show the Pytorch-like pseudocode of WaRPAD in Algorithm 1. Note that all operations allow batch-wise computation, hence we can process the input patches a batch-wise manner.
A.2 Further information of the Experiment settings.
Synthbuster. The Synthbuster benchmark consists 1000 real RAISE- Ik images and 9000 AI- generated images consisting of scene and art images under the 'CC BY-NC-SA 4.0' license. We download all real and Al-generated datasets in the URL via the author's 's official repository.
GenImage. The Genlmage benchmark consists of ImageNet real data and Al-generated data consisting different generative models under the 'CC BY-NC-SA 4.0' license. Each test consists of pairs of real and Al-generated image pairs, where the size is 6000+6000 except of SDv1.5, where size is 8000+8000. We download the datasets via the author's official repository
Deepfale-LSUN-Bedroom The Deepfake- LSe----ddNN--OO benchmark consists of 10000 real LSUN-Bedroom images and 10 x 10000 Al-generated data where the model trained to generate LSUN-Bedroom-like images. We download the datasets via the author's official repository under the 'CC BY 4.0' license.
Baselines, We follow the author's s implementation for the AEROBLADE and Manifold Bias respectively. Since the original implementation of the AEROBLADE operates the fixed dimension. extension to data with arbitrary size (e.g., Synthbuster, Genlmage) is not trivial. Our finding is that the preservation of the original dimension is crucial for the performance, hence we chose center-crop or resize the image to the fixed dimension of the autoencoder dimension whether the image is larger smaller than the autoencoder default dimension, respectively. On the other hand, have found any official implementation of the authors on the RIGID and MINDER. Instead, we manage reproduce the RIGID the consistent setting our WaRPAD, Note that RIGID and MINDER propose to resize the image to the default resolution of DINOv2, which is 224 x 224.
Experiment Settings. Most experiments deterministic since they operate deterministic operations. slight exception is RIGID, where the Gaussian noise augmentation is done on the
Phttps: htterp///DDaa..aas...uu..aAAA//p html
23

---

S
Dovi4
50V14
S0V14
50.1A
(a) Haar
(b) db2
(c) coifl
bior3.1
(e) coif3
Figure 7: Histogram of other wavelet. We show the results on Haar, db2, coifl, bior3.1, ,, and coif3 wavelet, respectively.
JPEG
Crap
No
0.7
AJROC
AUROC
03
0.3
0.
70
0.
08
0.7
06
0.5
0025
2000
0.075
0.100
0.126
(a) JPEG Compression
(b) Center Crop
(c) Gaussian Noise
Figure 8: Robustness of WaRPAD in corruptions. We test the AUROC performance WaRPAD, AEROBLADE, MINDER, and RIGID in corrupted test images in the Synthbuster benchmark.
image. However, our experiments in Table show that RIGID with multiple runs does not change much performance against RIGID with single seed.
Additional Backbones. All pre-trained backbones are accessible and downloadable. For the CLIP model, we use "clip-vit-base-32" for the base model. We use SwaV the Resnet50 [56] backbone and DINO of "vit-s16" version pre-trained on the ImageNet dataset. We use the "vit-mae-base" model for the ViTMAE backbone 12 and "beit-base-per pataaheepppchhte 16-224" model for the BeiT backbone
A.3 Histogram of other wavelet choices.
We show the computed histogram of WaRPAD on other wavelets (db2, coifl, bior3.1, and coif3), on real and SDv 1.4-1..eeoe 1.4-generated images computed in the Synthbuster benchmark in Figure 7. Results show DINOv2 model loses its robustness in other wavelet choices, especially wavelets with more vanishing moments.
A.4 Further robustness experiments
We further include the performance of WaRPAD, AEROBLADE, MINDER, and RIGID in the Synthbuster benchmark in Figure consistent to Figure 6. The trend consistent, where the WaRPAD performs the best.
9ttpp::/hhugiingfaeccoo// http://hhhhhaaeeocoo//////aasaaa patch32
24


Reviews:
[{"review_id": "Q8Q4rek54x", "reviewer": "Reviewer_pMdt", "summary": "Paper tackles AI generated image detection. Their contention is that real image distributions that current detection approaches can effectively cover remains extremely limited compared to the diversity of generated images. Growing need for detection methods that can operate universally across diverse domains without relying on the constraints of predefined real image distributions.\n\nThe paper leverages the fact that self-supervised models like DINO and DINOv2 are trained (a) solely on real images (b) are adversarially trained to be robust to random cropping and resizing (RRC), via (stronger global view) teacher (weaker augmented) student self-distillation. The main hypothesis of the paper is that embeddings of any AI generated image computed using this self-supervised model would be less robust to random cropping and resizing. This is due to a subsequent hypothesis, which is reasonably well known, that generative models do not model high frequency distributions well (yet).\n\nThe paper proposes a Haar-wavelet perturbation sensitivity score – for real images this score is likely to be higher. This is because the self-supervised model is robust to multiple scales and cropping augmentation for real-images. Then for an input image, they rescale it to some random value and patchify it, and average the score over each patch. This score is the WaRPED score acting as a one-class anomaly classifier.\n\nThen the paper compares the methods to other training-free methods and shows improvement. Seems like using a self-supervised model trained to be robust to RRC is key, as their score and rescaling-strategy with RIGID only marginally improves results.", "questions": "1.\tWhy handcraft the objective? Can you show either prior work or comparisons with trained methods that use self-supervised models? It seems like training a fixed DINO with an OOD classifier on top would be even better and achieve zero-shot generalization to all these datasets (this matches recent experience of many recent paper in a variety of domains -- e.g VGGT). The nice thing about a training approach is that it does not rely on a handcrafted signal, hopefully other signals (e.g. biological signals [a]) would not be correctly modelled by generative models when generating images in the future for us to be able to detect them reliably.\n\n2.\tToday, generative models do not model high frequency image components well, that may not be true tomorrow. Any suggestions on how to overcome that limitation?\n\n[a] FakeCatcher: Detection of Synthetic Portrait Videos using Biological Signals", "limitations": "Yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "1.\tThe motivation and the hypotheses makes sense. DINO and DINOv2 are both trained solely on real data (can be verified from the paper’s data mix), so generated images are OOD. The idea boils down to repurposing DINOv2 weights as a one-class classifier – which is a standard anomaly detection trick. But the challenge is to do this in a training free manner. This line of work makes a lot more sense to me than the ones using diffusion models – self-supervised models are carefully trained on real data (unlike \"web scale\" diffusion models), and that distribution is likely more constrained. A \"membership check\" on this distribution is a good way to identify anomalies.\n\n2.\tThe method also makes intuitive sense. DINO objective is to do self-distillation with an augmented student which is fed local crops and a teacher is which is fed global images – thus it will be robust to cropping and resizing. For an OOD sample, that the invariant is likely to not hold. \n\n3.\tMotivation of Haar-wavelet perturbation score. The authors also identify the reason for this OOD behaviour, generative models trained to match real image distributions can’t model high frequency well. This is quite well known. I think they should cite some analysis papers here to support their argument. But it all makes sense.\n\n4.\tComparison and results appear to be fair, they have tested a variety of methods and datasets. Ablations are also reasonable and cover most common questions.\n\nWeaknesses\n\n5.\tExploits a known property of existing generative models, and handcrafts a score function to be training-free. However, I’m not sure if that’s a good idea, why should this OOD classifier be training free and handcrafted, if we have deepfake datasets available to train on. Of course, one can leverage the DINO representations in that case too, by keeping it fixed. However, I’ll not penalize this specific paper too much on this, given that there is prior literature in the “training free” space, and this limitation likely applies to all of them. But I’d like the authors to answer the question for me, as I think this is an important baseline. In their introduction, the contention that “real image distributions that current detection approaches can effectively cover remains extremely limited compared to the diversity of generated images” is not shown.\n\n6.\tThe ablations and analysis can be more clearly written – the main points do not come out as effectively as the introduction and the method section.", "was_revised": true, "final_justification": "Authors have answered most of my concerns, I shall keep my rating.", "rebuttal": "Dear Reviewer pMdt,\n\nWe sincerely thank you for your helpful feedback and insightful comments. In what follows, we address your concerns one by one.\n\n---\n**[Q1]** Exploits a known property of existing generative models, and handcrafts a score function to be training-free. However, I’m not sure if that’s a good idea, why should this OOD classifier be training free and handcrafted, if we have deepfake datasets available to train on. \n\n**[A1]** We agree that when abundant real and generated images are available in a given domain, fine-tuning a classifier over the fixed foundation model may achieve stronger in-distribution performance. Indeed, most AI-generated image detection methods train and test on the same (or similar) real image distribution, assuming an abundance of real data. However, the availability of deepfake datasets may not always be the case in AI-generated image detection in practical scenarios, where it is practically impossible to collect data from all real domains. \n\nFirst, generalization to unseen real domains remains a significant challenge to the training-based/fine-tuning approach. While training-based detectors perform well on datasets they are exposed to (e.g., ImageNet, LSUN, Raise-1k), their effectiveness may deteriorate when deployed in out-of-distribution (OOD) domains such as artwork, medical imaging, or industrial anomaly data. For example, [1] proposes a FakeART benchmark of training on COCO/LSUN real images and examining on WikiART real images, where existing training-based methods (including FatFormer[2] that fine-tunes from CLIP) show underwhelming accuracy smaller than 60%.  Compared to the generalization capability of the DINOv2 backbone weight (which is often regarded as a robust, off-shell detector that show effectiveness on such domains without any fine-tuning [3,4]), the fine-tuned classifier may be more prone to the distribution shift and may require additional fine-tuning on that domain (see **[A3]** for the comparison against FatFormer). \n\nFurthermore, the real image data is often scarce or proprietary, especially in domains like healthcare or industrial anomaly detection. In such domains, relying on a pre-trained proprietary model or a generalist foundation model (like DINOv2) can be the best option for practical purposes. Many training-free approaches, including WaRPAD,  are designed to operate with minimal assumptions about internal model information. For example, WaRPAD only requires access to the output embeddings of a pre-trained, RRC-invariant model. This makes our approach suitable for restricted or black-box environments where model weights are inaccessible. \n\nIn summary, training-free approaches leverage versatile backbone models that often exhibit stronger robustness to OOD domains compared to fine-tuned classifiers, particularly in scenarios where training data are scarce or unavailable. Our approach aligns with the core philosophy of robustness-critical frameworks such as domain generalization. We will revise the contention statement in the introduction to more clearly reflect this perspective.\n\n---\n**[Q2]** The ablations and analysis can be more clearly written - the main points do not come out as effectively as the introduction and the method section.\n\n**[A2]** We thank the reviewer for the helpful suggestion. In the revised manuscript, we will reorganize this section to more clearly highlight the purpose and key findings of each experiment.\n\n---\n\n**[Q3]** Can you show either prior work or comparisons with trained methods that use self-supervised models? \n\n**[A3]** Thank you for your suggestion. Indeed, several works [2,5] fine-tune the lightweight detection module over the frozen self-supervised model backbone. For example, FatFormer [2] integrates a forgery-aware adapter module along with the image encoder of the CLIP model and a text-guided interactor module along with the text encoder of the CLIP model. We test the author’s official FatFormer checkpoint, which is trained on 4-class (car, cat, chair, horse) LSUN and ProGAN-generated data. \n\nWe compare the performance of FatFormer and WaRPAD, where the results are shown below. Overall, FatFormer underperforms over WaRPAD on average. In the LSUN-Bedroom benchmark, FatFormer shows near-perfect performance in detecting GAN-generated data, but the performance is degraded in detecting the diffusion-model-generated data. When the real data is more discrepant from the 4-class LSUN data, the performance gap is widened, and FatFormer consistently underperforms over WaRPAD in all generated data. \n\nFurthermore, we compare FatFormer and WaRPAD in the art-domain data. Since the FakeART benchmark in [1] is not public except for the information that they use the WikiArt dataset for the real data, we instead download data from the Kaggle webpage with 10821/10821 real and AI-generated data available, where the real data is from the WikiArt dataset. In the dataset, FatFormer’s AUROC is 0.531 while WaRPAD shows an AUROC of 0.765.  \n\nIn summary, the above experiments show that the fine-tuning-based method can underperform in generalizing to unseen real data distribution discrepant from the training real data distribution, which aligns with **[A1]**. While the generalization of such fine-tuning-based models can be improved by integrating more domain data and generative models in the fine-tuning phase, the availability of the training data might be limited in some domains, where our training-free setting truly shines. \n\n---\n\n(a) AUROC in Synthbuster.\n\n|Method|Firefly|GLIDE|SDXL|SDv2|SD13|SD14|DALL-E3|DALL-E2|Midj|Avg|\n|--|--|--|--|--|--|--|--|--|--|--|\n|FatFormer|0.586|0.718|0.707|0.513|0.486|0.500|0.186|0.571|0.374|0.516|\n|WaRPAD|0.927|0.999|0.830|0.775|0.959|0.958|0.422|0.930|0.702|0.834|\n---\n\n(b) AUROC in GenImage.\n\n|Method|ADM|BIGGAN|GLIDE|MIDJ|SD14|SD15|VQDM|Wukong|Avg|\n|--|--|--|--|--|--|--|--|--|--|\n|FatFormer|0.903|0.995|0.951|0.579|0.780|0.776|0.967|0.824| 0.847|\n|WaRPAD|0.986|0.998|0.991|0.810|0.940|0.936|0.981|0.924| 0.946|\n---\n\n(c) AUROC in Deepfake-LSUN-Bedroom.\n\n|Method|ADM|DDPM|DIFF-PjGAN|Diff-StyGAN|IDDPM|LDM|PNDM|ProGAN|ProjectedGAN|StyleGAN|Avg|\n|--|--|--|--|--|--|--|--|--|--|--|--|\n|FatFormer|0.745|0.709|0.998|1.000|0.824|0.944|0.999|1.000|0.999|0.988|0.921|\n|WaRPAD|0.785|0.937|0.988|0.965|0.908|0.940|0.970|0.995|0.986|0.870|0.934|\n\n---\n**[Q4]** Today, generative models do not model high-frequency image components well, that may not be tomorrow. Any suggestions on how to overcome that limitation?\n\n**[A4]**  We appreciate the reviewer’s perspective. Indeed, when future generative models can succeed in faithfully generating realistic images (including high-frequency components), any detection approach (including ours) may become less effective. We here suggest several research directions to mitigate this limitation and enhance the long-term viability of our approach.\n\nFirst, our score function can be extended beyond high-frequency wavelet statistics. For example, RRC might affect other spatial frequency bands, not just the high-frequency components. Integrating sensitivity on those mid-frequency bands might improve WaRPAD further. In addition, geometric augmentations (e.g., rotation) that are widely used in OOD detection [6] can be effective in revealing further discrepancies in generated data. \n\nFurthermore, future work may benefit by incorporating multimodal semantic understanding. While we currently operate in a training-free, vision-only setting, emerging multimodal foundation models [7,8] may eventually support zero-shot reasoning about the consistency between an image and its plausible semantics (e.g., physics, anatomy). As seen in some training-based detection methods [1,9], incorporating real-world priors can improve AI-generated image detection performance. We anticipate that multimodal foundation models pre-trained on world-knowledge-aligned data [10,11] could enable such reasoning in a training-free fashion in the future.\n\nIn summary, we expect that integrating mid-frequency stability and augmentation-specific inconsistencies at a vision level, and integrating multimodal priors, might be promising extensions to maintain the robustness of our approach. We leave this direction to future work.\n\n---\n**[Q5]**  The authors identify the reason for this OOD behaviour, generative models trained to match real image distributions can’t model high-frequency well. This is quite well known. I think they should cite some analysis papers here to support their argument. \n\n**[A5]** Thank you for the suggestions. We will add citations of the related papers [12,13] in the revised manuscript. \n\n ---\n**References**\n\n[1] Secret Lies in Color: Enhancing AI-Generated Images Detection with Color Distribution Analysis, Jia et al., CVPR 2025.\n\n[2] Forgery-aware Adaptive Transformer for Generalizable Synthetic Image Detection, Liu et al., CVPR 2024.\n\n[3] DINOSim: Zero-Shot Object Detection and Semantic Segmentation on Electron Microscopy Images, BioRxiv 2025.\n\n[4] AnomalyDINO: Boosting Patch-based Few-shot Anomaly Detection with DINOv2, Damm et al., WACV 2025.\n\n[5] Towards Universal Fake Image Detectors that Generalize Across Generative Models, Ohja et al., CVPR 2023.\n\n[6] Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty, Hendrycks et al., NeurIPS 2019.\n\n[7] Magma: A Foundation Model for Multimodal AI Agents, Yang et al., CVPR 2025.\n\n[8] BAGEL: The Open-Source Unified Multimodal Model, Deng et al., ArXiv 2025.\n\n[9] FakeCatcher: Detection of Synthetic Portrait Videos using Biological Signals, TPAMI 2020.\n\n[10] WISE: A World Knowledge-Informed Semantic Evaluation for Text-to-Image Generation, Niu et al., ArXiv 2025.\n\n[11] Envisioning Beyond the Pixels: Benchmarking Reasoning-Informed Visual Editing, Zhao et al., ArXiv 2025.\n\n[12] On the detection of synthetic images generated by diffusion models, Corvi et al., ICASSP 2023.\n\n[13] On the Frequency Bias of Generative Models, Schwarz et al., NeurIPS 2021."}, {"review_id": "fRi1C6wHrY", "reviewer": "Reviewer_39Dx", "summary": "The paper proposes WaRPAD, a training-free method for detecting AI-generated images by leveraging self-supervised models (e.g., DINOv2, CLIP) and their robustness to RandomResizedCrop (RRC) augmentation. It measures sensitivity to high-frequency perturbations via Haar wavelet decomposition. It uses multi-scale patching to simulate RRC effects, achieving strong performance and robustness across diverse generative models and image corruptions.", "questions": "See weakness.", "limitations": "Yes.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strength\n1) The paper is well-constructed, and the writing is of good quality.\n2) The method is simple but effective. The experiment is extensive, and the evaluation results seem good.\n3) The method is a training-free method and does not require additional training data. These advantages address a real open problem in the generated image detection domain.\n\nWeakness\n1) The main idea of WaRPAD is quite similar to RIGID, which limits its novelty.\n2) The motivation of HFwav(x) (Line-148) appears unclear. I would like the authors to provide additional theoretical analysis demonstrating how HFwav(x) reflects the model's robustness to RRC.\n3) As shown in Figure 2, the high-frequency components seem to correlate primarily with the proportion of detailed content in images. If this is the case, would the paper's hypothesis only apply to images with abundant details? For instance, when both real and generated images have low content complexity (i.e., fewer high-frequency details), would WaRPAD remain effective?\n4) Considering that ImageNet and LSUN (real-world datasets) images undergo post-processing operations, while synthetic data might not receive similar preprocessing, the effectiveness of WaRPAD might stem from detecting post-processing artifacts rather than synthetic artifacts. Notably, WaRPAD focuses on high-frequency differences between real and fake images. However, in the robustness experiments, the authors applied the same post-processing intensity to both real and synthetic images. This could still preserve inherent differences in post-processing characteristics (e.g., noise levels) between datasets.", "was_revised": true, "final_justification": "The rebuttal has addressed most of my concerns with clarifications or additional experiments. The author should incorporate all the information in the rebuttal into the final version.", "rebuttal": "Dear Reviewer 39Dx, \n\nWe sincerely thank you for your helpful feedback and insightful comments. In what follows, we address your concerns one by one.\n\n---\n**[Q1]** The main idea of WaRPAD is quite similar to RIGID, which limits its novelty\n\n**[A1]** We politely disagree with the reviewer’s assessment. Our WaRPAD differs from RIGID in the following perspectives: (1) the introduction of a patch-level robustness evaluation that captures localized embedding sensitivity, and (2) the perturbation strategy for robustness assessment. This is conceptually and methodologically distinct from prior works such as RIGID [1].\n\nFirst, unlike RIGID, which operates on a global image-level invariance, our WaRPAD analyzes local robustness by evaluating the average embedding stability across spatial patches processed by RescaleNPatchify. This patch-based analysis introduces a novel granularity that has not been explored in prior training-free methods.\n\nSecond, our HFWav score quantifies sensitivity across Haar Wavelet-decomposed directions, targeting high-frequency inconsistencies. In contrast, RIGID uses Gaussian noise augmentation.\n\nThese distinctions are empirically validated in our ablation study (Table 5), where simply combining RIGID with our patchification (RIGID + RescaleNPatchify) yields minimal improvement. In contrast, our full method, which integrates both the HFwav score and patch-based robustness, achieves significant performance gains, highlighting the novelty and necessity of our design. \n\n---\n**[Q2]** The motivation of HFwav(x) (Line-148) appears unclear. I would like the authors to provide additional theoretical analysis demonstrating how HFwav(x) reflects the model's robustness to RRC\n\n**[A2]** The HFwav score is designed to approximate a model’s robustness to RRC, particularly focusing on the high-frequency distortions introduced by the resizing component of RRC. Since directly applying RRC introduces stochasticity and multiple hyperparameters, we instead propose HFwav as a deterministic proxy that captures similar effects.\n\nWe clarify our motivation in two parts:\n- First, it is a well-established result in image processing that upsampling operations (which are always the case in RRC) distort high-frequency components of an image [2]. Specifically, the upsampling operation cannot faithfully reconstruct the original high-frequency signals [3,4]. These insights are empirically supported by our results in Figure 2, where upsampling distorts the high-frequency component of the original image.\n- Furthermore, DINOv2 is trained to be invariant to RRC augmentations on real images. Therefore, its embedding is expected to be robust to spatial high-frequency perturbations in real images. In contrast, AI-generated images exhibit different high-frequency signals [5,6] and are not part of DINOv2’s training data and thereby may exhibit unstable embeddings under such high-frequency perturbations. HFwav simulates this behaviour by measuring the directional sensitivity to high-frequency components (via wavelet decomposition), allowing us to approximate this differential robustness without explicitly applying RRC.\n\nAligned with the above motivation, we provide a theoretical analysis of the HFwav function. When the perturbation weight $\\alpha$ is small, we can approximate the normalized model output $g_{\\text{M}}(\\mathbf{x}-\\alpha \\text{HF}(\\mathbf{x}))$ using the first-order Taylor series expansion:\n\n$g_{\\text{M}}(\\mathbf{x} - \\alpha \\text{HF}(\\mathbf{x})) \\approx g_{\\text{M}}(\\mathbf{x}) - \\alpha J_{g_{\\text{M}}}(\\mathbf{x}) \\text{HF}(\\mathbf{x})$,\n\nwhere $g_{\\text{M}}(\\mathbf{x}) = \\text{norm} (f_{\\text{M}}(\\mathbf{x}))$ is the $\\ell_{2}$-normalized model representation and $J_{g_{\\text{M}}}(\\mathbf{x})$ denotes its Jacobian.\n\nUnder this approximation, the HFwav score becomes: \n\n$\\text{HFwav}(\\mathbf{x}) \\approx 1 - \\alpha g_{\\text{M}}^{\\top}(\\mathbf{x}) J_{g_{\\text{M}}}(\\mathbf{x}) \\text{HF}(\\mathbf{x})$.\n\nwhere the latter term $ g_{\\text{M}}^{\\top}(\\mathbf{x}) J_{g_{\\text{M}}}(\\mathbf{x}) \\text{HF}(\\mathbf{x})$ is the inner product between the embedding $g_{\\text{M}}(\\mathbf{x})$ and the directional derivative of $g_{\\text{M}}$ along the high-frequency direction $\\text{HF}(\\mathbf{x})$. This term quantifies the embedding shifts in response to its high-frequency perturbation. Following our motivation, the shift is expected to be smaller for real images (due to RRC-invariance) and larger for AI-generated images.\n\n---\n**[Q3]** As shown in Figure 2, the high-frequency components seem to correlate primarily with the proportion of detailed content in images. If this is the case, would the paper's hypothesis only apply to images with abundant details? For instance, when both real and generated images have low content complexity (i.e., fewer high-frequency details), would WaRPAD remain effective?\n\n**[A3]**  To simulate the scenario in which both real and generated images contain low content complexity (i.e., reduced high-frequency details), we apply an augmentation that center-crops the image by half along both width and height, resulting in a central ¼ area of the original image, and fills the remaining ¾ area with black pixels. This transformation significantly reduces the proportion of detailed content while preserving the structure of the image. \nWe evaluate WaRPAD and four baseline methods: RIGID, MINDER, AEROBLADE, and Manifold Bias, on this augmented dataset using the Synthbuster benchmark. The results are presented below, with the comparison against the unaugmented data as the reference.\n\nRIGID and MINDER, which rely on global image perturbation sensitivity, exhibit noticeable performance degradation under reduced content. A similar phenomenon is observed in AEROBLADE, which measures the image reconstruction error of the global image. In contrast, WaRPAD remains relatively robust. This robustness stems from our patch-level examination, where regions with high-frequency details are assessed independently. These results highlight WaRPAD’s resilience to content simplification.\n\n| |RIGID|MINDER|AEROBLADE|Manifold Bias|WaRPAD|\n|-|--|-|-|-|-|\n|Original|0.587|0.518|0.703|0.565|0.834|\n|Fewer details|0.521|0.473|0.663|0.580|0.834|\n\n---\n**[Q4]** Considering that ImageNet and LSUN images undergo post-processing operations, while synthetic data might not receive similar preprocessing, the effectiveness of WaRPAD might stem from detecting post-processing artifacts rather than synthetic artifacts. Notably, WaRPAD focuses on high-frequency differences between real and fake images. However, in the robustness experiments, the authors applied the same post-processing intensity to both real and synthetic images. This could still preserve inherent differences in post-processing characteristics between datasets\n\n**[A4]** As shown in Figure 8 of the Appendix (available in the supplementary material), we have already included a robustness experiment using the Synthbuster benchmark, where the real data is from the RAISE-1k dataset. This dataset consists of **unprocessed, uncompressed RAW images**. WaRPAD consistently outperforms other training-free methods under this setting across various corruptions on both real and fake data, suggesting that its performance advantage is not primarily due to detecting post-processing artifacts.\n\nTo measure the independent effects of post-processing artifacts on real and fake data, we conduct additional experiments using asymmetric corruption scenarios. First, we consider a scenario where real images remain unaltered and AI-generated images are corrupted. Second, we consider a scenario where real images are corrupted and AI-generated images remain unaltered.  All experiments are performed in the Synthbuster benchmark, with JPEG, Crop, and Gaussian noise, with corruption intensity of p denoted as J(p), C(p), and N(p), respectively.\n\nWhere only AI-generated images are corrupted, WaRPAD consistently achieves the best performance. While WaRPAD’s performance is reduced by the JPEG compression or Gaussian noise addition of the AI-generated images, a similar phenomenon occurs with other baselines as well. Moreover, RIGID and AEROBLADE exhibit severe performance degradation in the Gaussian noise perturbation.\n\nWhere only real images are corrupted, we again observe that AEROBLADE is particularly sensitive to Gaussian noise, indicating that it may be more susceptible to generic image artifacts rather than forensic signals specific to AI-generated content. In contrast, our WaRPAD demonstrates greater robustness across these variations.\n\n---\n\n(a): AUROC where only the AI-generated data is corrupted\n\n| |0|J(80)|J(60)|C(0.8)|C(0.6)|N(0.05)|N(0.1)|\n|-|-|-|-|-|-|-|-|\n|WaRPAD|0.83|0.71|0.64|0.88|0.84|0.62|0.60|\n|RIGID|0.59|0.54|0.53|0.60|0.63|0.20|0.09|\n|MINDER|0.52|0.51|0.47|0.46|0.47|0.51|0.52|\n|AEROBLADE|0.70|0.61|0.57|0.65|0.69|0.09|0.01|\n\n---\n(b): AUROC where only the real data is corrupted\n\n| |0|J(80)|J(60)|C(0.8)|C(0.6)|N(0.05)|N(0.1)|\n|-|-|-|-|-|-|-|-|\n|WaRPAD|0.83|0.82|0.85|0.83|0.83|0.87|0.91|\n|RIGID|0.59|0.60|0.62|0.60|0.58|0.64|0.71|\n|MINDER|0.52|0.52|0.51|0.53|0.51|0.51|0.52|\n|AEROBLADE|0.70|0.70|0.68|0.54|0.39|0.99|1.00|\n\n---\n\n**References**\n\n[1] RIGID, A Training-Free and Model-Agnostic Framework for Robust AI-Generated Image Detection, He et al., ArXiv 2024.\n\n[2] Spatial and Frequency Domain Comparison of Interpolation Techniques in Digital Image Processing, Poth and Szakall,  \nInternational Symposium of Hungarian Researchers on Computational Intelligence and Informatics, 2009.\n\n[3] Improving Feature Stability during Upsampling, Spectral Artifacts and the Importance of Spatial Context, Agnihotri et al., ECCV 2024.\n\n[4] Reversibility Error of Image Interpolation Methods: Definition and Improvements, Briand, IPOL Journal, 2019.\n\n[5] Fourier Spectrum Discrepancies in Deep Network Generated Images, Dzanic et al., NeurIPS 2020.\n\n[6] Leveraging Frequency Analysis for Deep Fake Image Recognition, Frank et al., ICML, 2020."}, {"review_id": "j0sXDAIrO2", "reviewer": "Reviewer_Lbu3", "summary": "This paper presents WaRPAD, a training-free method for detecting AI-generated images using self-supervised models. The key idea is that real images produce more stable embeddings under RandomResizedCrop (RRC) transformations, while synthetic images are more sensitive to such changes—especially in high-frequency areas. WaRPAD uses Haar wavelet decomposition to measure this sensitivity and computes a detection score by analyzing patches of resized images. The method works without any training, performs well across many generative models and datasets, and shows strong robustness to test-time image corruptions.", "questions": "The weakness is not really a weakness. But I would like to see some comparisons with supervised detectors on most recent gen-ai model (Flux for example).", "limitations": "No negative societal impact.", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength: \n1. The paper presents a clear and well-motivated problem, making it easy to follow the overall idea and reasoning behind the proposed approach.\n2. It proposes a training-free detection pipeline that combines RandomResizedCrop-based perturbation and Haar wavelet analysis to compute embedding sensitivity scores on self-supervised models. The method is simple yet effective, and the experimental results are very promising across various generative models.\n3. The ablation study is thorough and convincing, demonstrating the contribution of each component and validating the effectiveness of the proposed design.\n\nWeakness:\nWhile the paper compares against several training-free methods, it does not benchmark against recent supervised detectors or fine-tuned models, which would help establish the trade-off between accuracy and efficiency more clearly.", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer Lbu3,\n\nWe sincerely thank you for your helpful feedback and insightful comments. In what follows, we address your concerns one by one.\n\n---\n\n**[Q1]** While the paper compares against several training-free methods, it does not benchmark against recent supervised detectors or fine-tuned models, which would help establish the trade-off between accuracy and efficiency more clearly. \n\n**[A1]** We appreciate the suggestion. For the supervised detector, GenImage is a common benchmark, and we compare our WaRPAD against AIDE [1], a recent supervised detector trained in ImageNet images and SDv1.4-generated images. For the fine-tuned model, we compare ours against FatFormer[2], which integrates a training module alongside the CLIP model. FatFormer is trained on the 4-class LSUN (car, cat, chair, horse) images and ProGAN-generated images.\n\nWe present the results below. WaRPAD consistently improves over FatFormer on average. While FatFormer relatively performs well on a similar LSUN domain and detecting GAN-generated data, it loses robustness when evaluated under the discrepant real domains or when evaluated on detecting diffusion-generated data. On the other hand, WaRPAD performs comparable to AIDE on the GenImage benchmark with a gap of 2.3% and outperforms AIDE in other benchmarks with a larger gap.\n\n\n---\n\n(a) AUROC result on Synthbuster benchmark.\n\n| Method     | Firefly | GLIDE | SDXL | SDv2 | SD13 | SD14 | DALL-E3 | DALL-E2 | Midj | Avg  |\n|------------|---------|-------|------|------|------|------|---------|---------|------|------|\n| AIDE       | 0.165   | 0.780 | 0.835| 0.642| 0.946| 0.933| 0.415   | 0.426   | 0.688| 0.648|\n| FatFormer  | 0.586   | 0.718 | 0.707| 0.513| 0.486| 0.500| 0.186   | 0.571   | 0.374| 0.516|\n| WaRPAD     | 0.927   | 0.999 | 0.830| 0.775| 0.959| 0.958| 0.422   | 0.930   | 0.702| 0.834|\n---\n\n(b) AUROC result in GenImage benchmark.\n\n| Method     | ADM   | BIGGAN | GLIDE | MIDJ | SD14 | SD15 | VQDM | Wukong | Avg  |\n|------------|-------|--------|-------|------|------|------|------|--------|------|\n| AIDE       | 0.921 | 0.920  | 0.987 | 0.959| 1.000| 1.000| 0.965| 1.000  | 0.969|\n| FatFormer  | 0.903 | 0.995  | 0.951 | 0.579| 0.780| 0.776| 0.967| 0.824  | 0.847|\n| WaRPAD     | 0.986 | 0.998  | 0.991 | 0.810| 0.940| 0.936| 0.981| 0.924  | 0.946|\n---\n\n(c) AUROC result in Deepfake-LSUN-Bedroom benchmark.\n\n| Method     | ADM   | DDPM  | DIFF-PjGAN | Diff-StyGAN | IDDPM | LDM   | PNDM  | ProGAN | ProjectedGAN | StyleGAN | Avg   |\n|------------|-------|--------|-------------|-------------|--------|--------|--------|--------|---------------|----------|--------|\n| AIDE       | 0.636 | 0.722  | 0.860       | 0.951       | 0.679  | 0.807  | 0.941  | 0.899  | 0.910         | 0.840    | 0.825  |\n| FatFormer  | 0.745 | 0.709  | 0.998       | 1.000       | 0.824  | 0.944  | 0.999  | 1.000  | 0.999         | 0.988    | 0.921  |\n| WaRPAD     | 0.785 | 0.937  | 0.988       | 0.965       | 0.908  | 0.940  | 0.970  | 0.995  | 0.986         | 0.870    | 0.934  |\n\n---\n\n**[Q2]** Comparisons with supervised detectors on most recent gen-ai model (Flux for example).\n\n\n**[A2]** Thank you for the insightful suggestion. To investigate further, we construct a toy dataset using the “Jack-o-lantern” class from ImageNet, chosen because images in this category often feature black backgrounds, consistent with the scenario raised in **[Q3]** of the reviewer 39Dx. Specifically, we generate 1134 synthetic images using the \"black-forest-labs/FLUX.1-schnell\" model with the prompt “A photo of a jack-o-lantern”, and compare them against 1134 real images from the same ImageNet class.\n\nIn terms of AUROC performance, AIDE, WaRPAD, and FatFormer achieve scores of 0.995, 0.962, and 0.354, respectively. WaRPAD shows a relatively comparable performance to AIDE in this specific setting without any fine-tuning. \n\n---\n\n**References**\n\n[1] A Sanity Check for AI-generated Image Detection, Yan et al., ICLR 2025.\n\n[2] Forgery-aware Adaptive Transformer for Generalizable Synthetic Image Detection, Liu et al., CVPR 2024."}, {"review_id": "5lVRIvwjJM", "reviewer": "Reviewer_g2xN", "summary": "This paper proposes WaRPAD (Wavelet, Resizing, and Patchifying for AI-generated image Detection), a training-free method for detecting AI-generated images. The core insight leverages the inherent robustness of self-supervised vision models to the RandomResizedCrop  augmentation used during their pre-training.", "questions": "See Weaknesses", "limitations": "See Weaknesses", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths \nThe paper presents a highly innovative concept – exploiting the inherent RRC invariance learned by self-supervised models on real data as a discriminative signal for AI-generated image detection. \n\nWeaknesses\n1. Need Cross-dataset experiments. For example, training on GenImage, and testing on Deepfake-LSUN-Bedroom。\n2. While WaRPAD excels on average, Tables 2 & 3 show it can be slightly outperformed by AEROBLADE on specific models (e.g., Midjourney in Synthbuster, SDv1.4 in GenImage). Analyzing the characteristics of images/models where WaRPAD struggles slightly more could be informative.", "was_revised": true, "final_justification": "Borderline accept. The author has solved my concerns.", "rebuttal": "Dear Reviewer g2xN,\n\nWe sincerely thank you for your helpful feedback and insightful comments. In what follows, we address your concerns one by one.\n\n---\n\n\n**[Q1]** Need Cross-dataset experiments. For example, training on GenImage, and testing on Deepfake-LSUN-Bedroom.\n\n**[A1]** \nWe would like to clarify that our framework, WaRPAD, is a training-free method that does not require any training images. Therefore, when using our framework, the cross-dataset performance is identical to the reported results in our submission. In contrast, training-based/fine-tuning methods like AIDE [1] and FatFormer [2] could be very sensitive under the cross-dataset experiments. This is the main advantage of training-free methods, including our WaRPAD, over training-based ones. \n\nWe here examine our WarPAD against AIDE and FatFormer in the aforementioned benchmarks. To be specific, AIDE is a recent training-based method trained on the ImageNet real data and SDv1.4-generated data. FatFormer is a competitive fine-tuning-based method where additional weights are fine-tuned over the CLIP backbone. FatFormer is trained on 4-class (car, cat, chair, horse) LSUN data and ProGAN-generated data. Therefore, examining AIDE and FatFormer on our examined benchmarks (i.e., Synthbuster/GenImage/Deepfake-LSUN-Bedroom) corresponds to a cross-dataset experiment, except for evaluating AIDE on the GenImage benchmark. We use the pre-trained checkpoint from the official GitHub repository for evaluating the baseline methods.\n \nWe show the performance of AIDE, FatFormer, and WaRPAD below. WaRPAD consistently improves over FatFormer on average. Since FatFormer is trained on 4-class LSUN data and ProGAN-generated data, it achieves good performance when evaluated in the LSUN domain and when detecting GAN-generated data. However, its performance is limited in detecting diffusion-based models. While AIDE shows good performance in the GenImage benchmark, where the real image is from ImageNet, it loses robustness on other real domains.\n\n---\n\n(a) AUROC result on Synthbuster benchmark\n\n| Method     | Firefly | GLIDE | SDXL | SDv2 | SD13 | SD14 | DALL-E3 | DALL-E2 | Midj | Avg  |\n|------------|---------|-------|------|------|------|------|---------|---------|------|------|\n| AIDE       | 0.165   | 0.780 | 0.835| 0.642| 0.946| 0.933| 0.415   | 0.426   | 0.688| 0.648|\n| FatFormer  | 0.586   | 0.718 | 0.707| 0.513| 0.486| 0.500| 0.186   | 0.571   | 0.374| 0.516|\n| WaRPAD     | 0.927   | 0.999 | 0.830| 0.775| 0.959| 0.958| 0.422   | 0.930   | 0.702| 0.834|\n---\n\n(b) AUROC result in GenImage benchmark.\n\n| Method     | ADM   | BIGGAN | GLIDE | MIDJ | SD14 | SD15 | VQDM | Wukong | Avg  |\n|------------|-------|--------|-------|------|------|------|------|--------|------|\n| AIDE       | 0.921 | 0.920  | 0.987 | 0.959| 1.000| 1.000| 0.965| 1.000  | 0.969|\n| FatFormer  | 0.903 | 0.995  | 0.951 | 0.579| 0.780| 0.776| 0.967| 0.824  | 0.847|\n| WaRPAD     | 0.986 | 0.998  | 0.991 | 0.810| 0.940| 0.936| 0.981| 0.924  | 0.946|\n---\n\n(c) AUROC result in Deepfake-LSUN-Bedroom benchmark\n\n| Method     | ADM   | DDPM  | DIFF-PjGAN | Diff-StyGAN | IDDPM | LDM   | PNDM  | ProGAN | ProjectedGAN | StyleGAN | Avg   |\n|------------|-------|--------|-------------|-------------|--------|--------|--------|--------|---------------|----------|--------|\n| AIDE       | 0.636 | 0.722  | 0.860       | 0.951       | 0.679  | 0.807  | 0.941  | 0.899  | 0.910         | 0.840    | 0.825  |\n| FatFormer  | 0.745 | 0.709  | 0.998       | 1.000       | 0.824  | 0.944  | 0.999  | 1.000  | 0.999         | 0.988    | 0.921  |\n| WaRPAD     | 0.785 | 0.937  | 0.988       | 0.965       | 0.908  | 0.940  | 0.970  | 0.995  | 0.986         | 0.870    | 0.934  |\n---\n\n\n\n**[Q2]** While WaRPAD excels on average, Tables 2 & 3 show it can be slightly outperformed by AEROBLADE on specific models (e.g., Midjourney in Synthbuster, SDv1.4 in GenImage). Analyzing the characteristics of images/models where WaRPAD struggles slightly more could be informative.\n\n\n**[A2]**  Thank you for the suggestion. Comparing AEROBLADE and WaRPAD directly can be challenging since they are based on different backbone models: AEROBLADE uses an autoencoder (e.g., VAE), and WaRPAD uses DINOv2. Specifically, AEROBLADE utilizes the reconstruction distance between the input image and its reconstruction via the autoencoder of the latent diffusion model. If the generated image is from the examined autoencoder, it will show a lower reconstruction distance under that autoencoder. Hence, for LDM-based models like SDv1.4/SDv1.5/Wukong, where the generative model’s autoencoder is the same as the examined autoencoder  (we use SDv1.4 for the examination), AEROBLADE ought to show good performance. While Midjourney is not directly analyzable since it is a proprietary model, the results suggest that AEROBLADE may also be specialized in detecting Midjourney-generated data compared to our DINOv2 backbone. \n\n---\n\n**References**\n\n[1] A Sanity Check for AI-generated Image Detection, Yan et al., ICLR 2025.\n\n[2] Forgery-aware Adaptive Transformer for Generalizable Synthetic Image Detection, Liu et al., CVPR 2024."}]

Author rebuttal:

Meta-review: During discussion period, the authors and reviewers have comprehensive discussions, and all reviewers agree to accept this paper.
Decision: Accept (poster)