Detecting Generated Images by Fitting Natural Image Distributions
Authors: Yonggang Zhang
Jun Nie
Xinmei Tian
Mingming Gong
Kun Zhang
Bo Han
Venue: NeurIPS 2025 spotlight ()
Keywords: Generative models
Generalization
Detection
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: The increasing realism of generated images has raised significant concerns about their potential misuse, necessitating robust detection methods. Current approaches mainly rely on training binary classifiers, which depend heavily on the quantity and quality of available generated images. In this work, we propose a novel framework that exploits geometric differences between the data manifolds of natural and generated images.  To exploit this difference, we employ a pair of functions engineered to yield consistent outputs for natural images but divergent outputs for generated ones, leveraging the property that their gradients reside in mutually orthogonal subspaces. This design enables a simple yet effective detection method: an image is identified as generated if a transformation along its data manifold induces a significant change in the loss value of a self-supervised model pre-trained on natural images. Further more, to address diminishing manifold disparities in advanced generative models, we leverage normalizing flows to amplify detectable differences by extruding generated images away from the natural image manifold. Extensive experiments demonstrate the efficacy of this method.

Detecting Generated Images by Fitting Natural Image Distributions
Yonggang Zhang'
Jun 2ie Xinmei Tian Mingming Gong Kun Zhang*6 Bo Han
'hh Hong Kong University of Science and Technology
TMLR Group, Hong Kong Baptist University University of Science and Technology China "The University of Melbourne, Australia CCarnegie Mellon University 6 Mohamed bin Zayed University of Artificial Intelligence
Abstract
The increasing realism of generated images has raised significant concerns about their potential misuse, necessitating robust detection methods. Current approaches mainly rely on training binary classifiers, which depend heavily on the quantity and quality of available generated images. In this work, we propose novel framework that exploits geometric differences between the data manifolds of natural and generated images. To exploit this difference, we employ pair of functions engineered to yield consistent outputs for natural images but divergent outputs for generated ones, leveraging the property that their gradients reside mutually orthogonal subspaces. This design enables simple yet effective detection method: an image identified as generated if transformation along its data manifold induces a significant change in the loss value of a self-supervised model pre-trained on natural images. Further more, to address diminishing manifold disparities advanced generative models, we leverage normalizing flows to amplify detectable differences by extruding generated images away from the natural image manifold. Extensive experiments demonstrate the efficacy of this method. Code is available at https:: h/tp:::///gtttttt www.:/oooooo//i///eeeee coon/mmrr-ee comp://ni-----gru////on
INTRODUCTION
Recent advances in generative models have revolutionized image generation, making it possible to create highly realistic images (Rombach et al., 2022; Dhariwal and Nichol, 2021; Karras et al., 2019). While these generative models offer impressive capabilities, they also introduce significant risks, including the proliferation of deepfakes and other manipulated content. The realism achieved by these technologies raises urgent concerns about their potential misuse in sensitive areas like politics and economics. Moreover, if we simply use generated images as part of the training data, the trained model may largely degrade quality (Shumailov et al.,, 2024), so is essential distinguish between natural images and generated ones. To deal with these potentially dire risks, various generated image detection methods have been developed. In this regard, a common approach is to consider generated image detection binary classification task. To train binary classifier for detecting generated images, current methods typically require to collect numerous natural and generated images to construct training dataset (Chai et al., 2020; Wang et al., 2020).
Although current methods have achieved exciting success, they often struggle to generalize well to images generated by unknown generative models. To promote the generalization ability on images generated by unknown generative models, one possible approach is to construct a more extensive training dataset by collecting more natural and generated images for training the binary classifier (Jcong et al., 2022; Tan et al., 2024). Besides collecting data, advanced methods propose to
1 Cooreeppnndecce to Bo Han (bhanml @ @ww.@@oooo.o..uuuu......
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

1
6xx))= = 1(((xa)
-f((x0)1 00 6(xxc) (<(())))) - (x(xee))
A (pp
fe(x,)
(
f2(
Binary classifier
Function-1
Function-2
Function-1
Function-2
Zg
X
(a)
(b)
Figure 1: Comparison of (a): the existing framework, and (b): our proposed ConV. The binary classifier in (a) is trained using natural images X.M and generated images Xg. thereby, its efficacy relies on both the natural and generated data distributions. In contrast, the two functions in (b) are trained natural data distribution, leading to the advantage of ConV: identifying generated images by fitting the distribution of natural images rather than that of generated images.
BigGAN
VQDM
Midjourney
Stable Diffusion Stable Diffusion ADM V1.4
V1.5
Figure 2: Generated images deviate from natural images' manifold, but the deviation decreases as generative model evolves. Red dots denote the feature representations of natural images, while purple dots represent those of generated images.
introduce pre-trained models as priors promote the generalization ability. Some works, inspired by the recent success of large models, propose to detect generated images by leveraging features extracted by these large models (Ojha et al., 2023; Liu al., 2024b), such as CLIP (Radford al., 2021), I). Meanwhile, some works propose to leverage the reconstruction capabilities of pre-trained diffusion models (Wang et al., 2023; Ricker al., 2024). Although these methods have achieved outstanding results, they require lot of natural and generated images to train a binary classifier, making the current methods computationally intensive. Moreover, sustaining robust detection performance necessitates the continual collection of images generated by the latest generative models, which can be costly or even infeasible due to the inaccessibility of potential models, e.g., Sora OpenAl (2024).
Hence, the major challenge for the existing methods is ensuring that the binary classifier generalizes effectively across diverse unknown generative models. This stems from the fact that these binary classifiers are trained over natural and generated images to distinguish between these two types of images. Thus, the performance of these binary classifiers relies on the diversity of generated data. Unfortunately, it is challenging to determine whether a binary classifier trained over images generated by some diffusion models can generalize to those generated by other models. Their defects of heavy dependence on generated image distribution underscore the necessity of exploring a novel framework for generated image detection, where the detector's 's performance relies on the natural data distribution rather than the generated image distribution. However, this remains challenging, because the literature has yet to determine whether models training merely on natural images can be leveraged to distinguish between natural and generated images effectively, and if yes, how and why?
To address the challenge, consistency verification (Con Using t-SNE, we visualize the low-dimensionall manifold structure of feature representations extracted by DINOv2, which is trained solely on natural images. The embeddings of generated images exhibit distinct patterns compared to those of natural images, as illustrated Figure supporting the manifold disparities leveraged by our detection framework. To exploit this difference for detecting Al Al-generated images, as shown in Figure 1, we introduce two functions, aiming to detect generated images by ensuring that the outputs of these functions remain consistent for natural images but exhibit significant inconsistency for generated images. To this end, we establish a principle (see Eq. 6) to design these functions based on our theoretical analysis: outputs of these two functions are the same the natural distribution while their gradients need to lie within two mutually orthogonal subspaces. This enables training-free detection approach (see Eq. 12); if an image transformed along its data manifold induces a substantial change in the
propose novel framework for detecting generated images called

---

loss value of self-supervised model pre-trained over natural images, it is identified as generated. The advantage of ConV over existing methods is its reliance on fitting the natural data distribution rather than the distribution of generated images. However, as the generative model continues to develop, the deviation between the generated image and the natural image manifold will become smaller, as shown in Figure 2. To address this challenge, we propose actively projecting generated images onto the natural image manifold. The inherent diversity of natural images complicates explicit modeling of this manifold. To overcome this, we employ normalizing flow (Dinh et al., 2017; Kingma and Dhariwal, 2018) to transform the natural image manifold into a Gaussian distribution, enabling precise extrusion of generated images from the natural manifold. This approach significantly enhances detection performance. Comprehensive experiments across various benchmarks for generated image detection demonstrate the effectiveness of the proposed ConV (see Tables 1-7). To further verify the effectiveness of the proposed Con we collect images generated by Sora OpenAl (2024) and OpenSora Zheng al. (2024) and compare ConV with baselines. The experiments demonstrate the efficacy and robustness ConV against variations in generative models (see Table 2).
We summarize our main contributions follows:
We highlight the generalization issue of existing works: it is challenging to determine whether detector trained over images generated by some diffusion models can generalize to those generated by other models. This motivates a promising direction to explore detectors whose detection ability relies solely fitting the natural data distribution.
We propose a novel framework for detecting generated images called consistency verification (ConV). This framework exploits the observed deviation of generated images from natural manifold and detect images by verifying consistency of two functions. The design of these functions is guided by our orthogonality principle. Namely, gradients of these functions need to lie within two mutually orthogonal subspaces (Eq 6). This enables training- approach to detecting generated images by leveraging the consistency of a pre-trained self-supervised model on images before and after perturbations along the data manifold.
To further facilitate the deviation of the generated image, we explicitly extrude generated images out of natural manifold with the aid of normalized flow, enhancing the effectiveness of ConV. Extensive experiments conducted on various standard benchmarks and datasets collected from Sora demonstrate the effectiveness and robustness of the proposed method.
2 Consistency Verification
2.1 Motivation
Humans can distinguish generated images from natural images through some types of indescribable differences in patterns. Intuitively, humans know that if a natural image captures the same content as a given generated image, the natural image will be different. In contrast, if we degrade natural images along its data manifold, e.g., tiny affine transformation, the degraded natural images are still discriminated as natural images.
Xg
Tangont space
XM (xz)
Manifold
To formally characterize this discrepancy, we present the fol- lowing notations. Let x E X' C Rd denote the image, where denotes the dimension of images. To distinguish, we use x,, and x, to denote the natural and generated image. In particular. for a given generated image Xg. even if it captures similar content to a natural image X,,, humans know they are distinguishable in certain ways. This can be formulated by projecting the generated image Xy onto the point x MM(x)) on the data manifold M, i.e.,
Figure 3: Illustration of projecting a generated image x., onto the data manifold M.
(x,) = arg min d(x',x,), xx,(x,) E M, X2 $ M, x' EM
where (x, is the point closest x, on the data manifold of natural images M and d is metric. Namely, images on the data manifold M are considered natural, whereas those deviating from M regarded generated.
In this context, the data manifold perspective provides an intuitive framework for understanding the difference. In particular, transforming natural image xMM along the local tangent space T TxxM).
3

---

leading to the fact that the degraded images are still on the data manifold. In contrast, even the discrepancy (x,) ) minimal, x, is considered as generated, because x, departs from the manifold. Intuitively, even a slight discrepancy between (x and Xg allows us to identify the difference between a generated image and the corresponding natural image on the data manifold. Thus, we consider the discrepancy between generated image and its closest natural image on the data manifold to represent the direction of the fastest departure from the manifold. This means that
(xM(x,) - xg) = 0, v (xg)(xg))
This discrepancy inspires us introduce two functions to detect generated images, where these two functions are related to the tangent space and the space orthogonal to the tangent space, respectively.
2.2 Objective
Aligning with the motivation, introduce two-function framework for generated image detection. In particular, we propose a consistency verification framework where the two introduced functions devised to be consistent over natural images and inconsistent over generated images. Namely, this framework detects generated images by verifying the consistency of the two functions. Specifically, let (i) Rd + IR and f2(-): Rdd + IR be the two functions. Then, the inconsistency [-i(-) - f2(-) between these two functions can be employed to detect generated images. Namely, generated images can be detected by I((ff(-) - f2(-) > a) with the threshold a.
For images on the manifold, we make these two functions consistent by setting
5(xm) (xx) fa(xm)) 0,
where we denote X.M (X,) as XM for simplicity. Then, the objective is to devise the two functions to ensure that the inconsistency over generated images larger than that over the natural images, i.c.. 6(g)) 2 5(xM). In this regard, we show that (with more details in the appendix)
8(x,)> > (x
T (x,- xM) [2 (x, xMM 2 0 8(xM),
(4)
where equality holds if, and only if, the absolute values of the two quantities are identical. According (xxM))((x (x,
to Eq. 4, enlarging the difference between these two terms, i.e., V (X
xMM) and XM)) I will make the natural and generated images separable. Thus, the objective
VV f2(xM)) of consistency verification to maximize one term and minimize the other term while keeping the output values of these two functions the same. This can be formalized by
min f1.F
V. (xx) (oxn))(xx,,)) (x, xM)] V - xxM).. s.t. fi (xx)) = f2(XM),
(5)
where F denotes a hypothesis space.
However, learning these two functions using Eq. 5 still relies on the generated data, i.e., Xg- To decouple function optimization from the generated data distribution, we leverage orthogonality priors from the motivation 2.1 to provide design principles for these functions. According to the above discussion, one straightforward approach to realizing Si and f2 is to devise these functions such that their gradients for the input lie in two orthogonal subspaces, i.e., the tangent space and the space orthogonal to the tangent space. This orthogonality principle can be formalized as,
(x(M) E O(xM), f2(M)) E T(xM), (x(m) = fx(x))
(6)
where ((xM) denotes the subspace orthogonal to the tangent space T(xx)). Then, we have 8 8(x,) 2 ( pl (22(x)) T pll (x)) pl
5(x,),,
where p= Xg- XM denotes the difference between a generated image and its corresponding point on the data manifold, the equation holds due to the conclusion in Eq. 2, and the inequality holds because the probability that two vectors in the same space are orthogonal is zero. Consequently, the orthogonality principle ensures that these two functions are consistent on natural images, i.c..
(x = f2(XM), while inconsistent on generated images, i.e., 16(x,) > 18(xM) = 0.
2.3 Realization
In this work, we propose a training-free approach to construct these two functions. The reason is twofold: i) our framework allows the training-frre free construction of these functions, and ii) aim to

---

validate the effectiveness of the orthogonality principle without incurring significant energy costs, as fitting the distribution of natural data requires lot of data and computing power for training.
Well-trained models are typically insensitive to the transformation along the data manifold Simard al. (1991); Bengio et al. (2013); Rifai et al. (2011) I). This can be formalized as,
- (v-xM) de(xM) = O, VE (xxx)
(8)
0xm
where v stands for the point sampled from the tangent space T(x.) and f(-) is the loss function of
model. This implies that 06(xM) is orthogonal to the tangent space T(xM), which is consistent
dx with the direction p X XM. as shown in Eq 2. Hence, we propose to realize fi(+) using well-trained neural network. This means that both df(xM) and p lies the subspace orthogonal to tangent space (XxM). This is consistent with the principle, i.e., (x((xM) E Oxx). We have
8x.
(x() pl 3l(xM) pl [l(x)) dxm
|P|| cos( dl(xm) P) > 0, 0xm
(9)
0xm
where p Xg XM is the difference between natural and generated images, and the last inequality holds because the probability that two vectors in the same space are orthogonal is zero. We propose to realize (-) using models trained with self-supervised learning, which would avoid reliance on labels used in classification tasks. This because obtaining the loss value of a classification model requires labels that could be hard to obtain in many practical scenarios.
For the second term, we will realize it using the orthogonality such that f22(x E T(xx) or f2(XM) pl = O. We achieve this by introducing the local tangent space into V (x).. To this end, we propose to realize fo using a composite function: f2 == o h. This leads to the fact that
f2(xM) = JR(xM) ()())(M))
(10)
0h(xM)
where J J)(x)) is the Jacobian matrix of h(xM). If h(-) models the transformation along local data manifold, J ((xM) models the tangent space at point XM- Then, we have
fe(x)) p= (f(xM())))
J J)(xm)P=0 =0
(11)
@h(xm)
where J ((x) denotes the tangent space orthogonal to the vector p Xg - XMM see Eq. 2.
For the last term in the orthogonality principle, we should ensure that (1(M) = (2(XM)
fh((xx))). There are numerous approaches to realize h(-). In this regard, we propose to leverage data transformation functions used in the training phase to realize ht-), because self-supervised models are trained to be insensitive to these transformations along local data manifold under various self-supervised learning scenarios (Yu al., 2023; Jaderberg al., 2015). Thus, for given input image x, we can determine whether it is generated by calculating the consistency 8(x),
{= O, XE
5(x) = (x) - (1(xx))((((())
(12)
> 0, x E
Technically, our training- training-frre realization is equal to verifying the robustness of a pre-trained self- supervised model (-) against the data transformations hu(-). Here, fi(-) merely fits the natural data distribution, avoiding the reliance on the distribution of generated images.
2.4 Overview
An overview of the proposed consistency verification is presented in Figure 4. As shown in the figure, our method is training-free and seamlessly deployed in practical scenarios. Specifically, we merely download neural network pre-trained with a self-supervised learning task over large-scale dataset. Subsequently, we obtain the loss values of both the original and transformed images. Ultimately, images are identified as generated the difference between loss values exceeds a predetermined threshold. We can apply multiple random transformations and compute corresponding loss function values if computational resources allow. Intuitively, this would result more accurate detection performance, which is fortunately consistent with experiments, Figure 5.
5

---

Negative samples are widely used in self-supervised learning, which could increase the computational cost of generated image detection. Inspired by recent work Oquab et (2024), we calculate the similarity of representation r = x(x), where Φ(.) is the feature extractor of self-supervised model. The feasibility results from the objective function used in self-supervised learning.
eir rr/T)//)
log P(x) = log
Σg r(/r-//) eel ra/r) log
Σg (1/ (13)
where ra is the representation of h(x) and denotes the representation of negative samples. Thus, we can employ the similarity between representations, i.e., r r.,, rh, as surrogate of loss value. This avoids the use of negative samples. Note that applying a softmax function to the representation r leads to the objective function used in previous works Caron et al. (2021); Oquab et al. (2024). In this context, the high similarity between the representation of images and transformed images means the consistency between functions, i.e., detected natural images.
2.5 Flow-Based Manifold Extrusion
Although generated images, such as those gener- ated by GANs diffusion models, deviate from the manifold of natural images, this deviation is often subtle, making differentiation challenging. To address this, we aim to actively extrude gen- erated images from the natural image manifold through targeted training, thereby amplifying their separation. However, the challenge comes from the diversity of natural images, which leads to their extremely complex manifolds. This com- plexity prevents direct modeling of natural man- ifold. To address this challenge, we propose F-ConV to leverage normalizing flows (Dinh et al., 2017) to reshape the natural manifold into a Gaussian distribution, facilitating robust differentiation.
fi(x)
5(x) 1((x)) (
h(x)
h
((h(x))
6(x) = M
8(x) 0,1f
f2 - fi
Figure 4: Framework consistency verification.
The goal of the normalizing flows is learn an invertible mapping f. which transforms a complex distribution Px (v) into simple one P2(=): = f(v) and is the image feature extracted by the fundamental model: v ((x The distribution Pz(z) is commonly chosen be standard Gaussian. Therefore, the objective function for normalizing flow is: Formally, let f Rd R be the invertible transformation, mapping an input feature v to a latent variable 2 = f(v), where (0, According to the change of variable formula, the ligeliiiddood of is:
logp(1) = log ([g)=(((v)) + log det (of(o) Ov
(14)
where det (8(()) de
is the determinant of the Jacobian matrix of f at v. order to enforce the deviation of the generated image, we introduce the following loss function:
EEWD, logp(v) + Eu-D, (og)(v) ( (o + (or,,))))) oogn
Shaping Loss
Consistency Loss
(15)
where D,, and Dy denote the distributions of natural and generated images, respectively. T(u) the feature of transformed image: T(x) fx())). Intuitively, shaping loss pushes the generated images away from natural images' manifold, while the consistency loss amplifies consistency disparity between natural images and generated images. Upon completion of training, we make judgment of an image by assessing the feature consistency between the original image and its transformed image, well as its likelihood under the normalizing flow model.

---

Table 1: Detection performance (%) on ImageNet. Bold numbers are superior results. We compare
training methods and training- free methods separately.
Methods
ADMG
LDM
DIT
BigGAN
GiAGIAN AUROC
StylGAN AUROC
RQ To-Taasfoomer
GIT
AUROC
AP
NUROC
AP
AUROC
AP
AUROC
AP
AUROC
AP
AP
AP
AUROC
AP
ALBOC
AP
AUBOC (T) AP
CINNgg
62:25
63.13
63.28
63.16
64:11
02.85
85:71
$2.93
74.85
T1
64:41
66.67
61:83
62.91
01154
67.04
06:78
Ojta
83.37
62.95
79.50
78.15
$0.35
71
$2.93
51.72
93.07
92-77
87.45
64.88
85.35
$3.15
85.19
66.22
90.53
93:71
85.35
64.25
DIRE:
51882
30.29
53.14
52.96
52.83
51.84
$4.67
55.10
51.82
50.33
50.30
50.27
56.5
51.36
55.95
54.83
52.58
$2.10
$2.30
52.18
NPPR
00.85
91:88
89-71
81-11
78:
84.13
13
8933
71:28
85:00
50.84
FagFornes
E-CuVV
92.74
91.63
88.51
87.67
85.57
58.47
$5.94
54.38
98.94
98.98
98.04
98.72
98.93
98.38
96.79
96.33
05.52
95.35
93.77
93.38
Transng:
Mettidd
Table 2: Detection performance (%) on Sora.
Methods
Model
CNNNspol
Ojha
NPR
DRCT
DIRE
FalFomer
F-ConV
AEROBLADA
Con'V
AUROC
AUROC
AP
AUROC
AP
AUROC
AP
AUROC
AP
AUROC
AP
AUROC
AP
AUROC
AUROC
AP
Sora
52.85
51
50.25
82.55
52.16
87.64
91.74
57.13
N7.74
Open
50.14
50.25
$2.95
87.35
55.79
82.84
Average
51.50
52.84
72.06
74.68
51.09
51.05
82.16
51.20
52.57
89.36
87.82
90.95
88.67
30.46
85.29
3 Experiments
3.1 Experiment setup
Datasets. Following previous work (Chen et al., 2024), we evaluate ConV on several benchmarks: ImageNet (Deng al., 2009), LSUN-BEDROOD (Yu et al., 2015), GenImage (Zhu et al., 2023b) and DRCT2M (Chen et al., 2024). Detailed dataset description can be found in the Appendix G.
Besides these image dataset, current advancements in generative technology have significantly enhanced the realism of synthetic videos (Khachatryan et al., 2023; Blattmann et al., 2023), thereby raising substantial concerns regarding trust in digital media. Moreover, the inaccessibility of their parameters and even their architectures underscores the necessity of verifying the generalization capability of newly proposed detection methods over these generative models. To verify whether the proposed ConV generalizes to these challenging scenarios, we download videos generated by these models and detect images sampled from these videos. Since we currently cannot access the generative model used in Sora (OpenAI, 2024), we gathered several vidcos and extracted 1, 000 frames. Additionally, we generate 100 videos through the open-source OpenSora project (Zheng et al., 2024), extracting 5, 000 frames. With these images used as generated images and Laion serving as natural images, further evaluate Con performance and compare it with baselines.
Baselines and evaluation metrics. We use training-free and training-based methods as base- lines. For training-free methods, we take AEROB- LADE (Ricker et al., 2024) as baseline. For training-basee methods, we take DIRE (Wang et al.,
87
85
AUROC
2
86
AUROC
84
2023), CNNspot (Wang et al., 2020), Ojha (Ojha et al., 2023), DRCT (Chen et al., 2024), Fat- Former (Liu et al., 2024a) and NPR (Tan et al., 2024) as baselines. For some baselines, we get the results reported in their papers, including Frank (Frank et al., Figure 5: Con'V with multiple forward passes.
AP
10
20
30
2020), Durall (Durall et al., 2020), Patchfor (Chai et al., 2020), F3Net (Qian et al., 2020), SelfB- land (Shiohara and Yamasaki, 2022), GANDetection (Mandelli et al., 2022), L.Grad (Tan et al., 2023), DeiT-S (Touvron et al., 2021), Swin-T (Liu et al., 2021). Spec (Zhang et al., 2019), GenDet (Zhu et al., 2023a) and GramNet (Liu et al. 2020). And following previous works (Ojha et al., 2023: Tan et al., 2024), we mainly use the following metrics: (1) the average precision (AP); (2) the area under the receiver operating characteristic curve (AUROC) and (3) the classification accuracy (ACC).
Implementation details. In our experiments, we use the DINOv2 to instantiate f-(.) and common transformation (details are in Appendix E) to realize h(.). There four pre-trained DINOv2 models, i.e., ViT-S/14, ViT-B/14, ViT-L/14, and ViT-g/14, achieving exciting AUROC performance on ImageNet benchmark: 62.84, 78.58, 87.13, and 85.97, respectively.
To balance detection performance and efficiency, we use DINOv2 VIT-L/14 in the following ex- periments. Meanwhile, We leverage data augmentations used in the training phase to realize the
7

---

Density
Al-generated Images
Density
Al-generated Images
Density
Al-generated Images
Natural Images
Natural Images
Images
0.6
0.7
0.8 Cosine Similarity
0.9
1.0
0.8
0.9
1.0
0.7
0.8
0.9
1.0
Cosine Similarity
Cosine Similarity
Figure 7: Cosine similarity between features of x and h(x),, where generated images are generated by BigGAN, b) ADM, and c) DDPM.
function h(-) in fz = fi h, including geometric augmentation, color jitter, and Gaussian blur. Since data augmentation is randomized, to enhance performance, we apply the function n times to single test image. As illustrated Figure 5, increasing n correlates with improved detection performance. However, to maintain detection efficiency, we set = 20 in our experiments. In practical applications, if multiple machines are available, we can leverage parallel processing to implement multiple transformations in a single forward pass to achieve better detection performance. In our experiments, we report the average results under five different random seeds. For F-Con we train a RealNVP (Dinh et al., 2017) on the top of DINOv2 ViT-L/14, which consists of 2 coupling blocks with fully connected networks as internal functions. The model is trained using Adam with learning rate of 1e-5. More detailed implementation information is provided in Appendix F.
3.2 Main Result
Comparison on public benchmarks. We conduct comparative experiments across a comprehensive suite of standard benchmarks. As shown in Tables 1, 7, 9 and 8, without training, ConV achieves comparable performance to training methods. And Con performs better than some of advanced training methods in out-of-distribttion generative models. When further extruding the generated image out of natural images' manifold through training, F-ConV achieves the best performance, illustrating the effectiveness of the generalization ability of the proposed method.
Comparison on Sora. We further evaluate ConV's performance on videos generated by unknown models. As shown in Table 2, ConV demonstrates the best performance images generated by these unknown generative models, previous methods. These results highlight the effectiveness and robustness of the proposed ConV.
We visualize the features of natural image and generated image Xg well as the features of their augmented versions, i.e., (x,,) and l(x,)). We extract features of X,, Xg. l(x,)) and h(x,) using DI- NOv2 and use t-SNE to visualize these features. To avoid the effect of class, all images are sampled from the same class for visualization. As shown in Figure 6, the conclu- sions are mainly twofold. First, the features of natural (x,) and augmented (h(x,)) images can distinguished from those of generated images and their augmented versions, showing DINOv2's 's ability to differentiate between natural and generated images. This provides promising direction to leverage DINOv2 for generated image detection. Second,
Illustration of the effectiveness.
Figure t-SNE visualization of fea- tures extracted by DINOv2. Natural image features ( and remain nearly unchanged after transformations, caus- ing overlap, while generated image features (- and show notable shifts. the separation between generated image and its augmented version in the representation space is more pronounced than that of natural images. The feature of f(xx)) is similar to that of Xx, i.c., features of (xx,,) substantially overlap with those of the natural image X., In contrast, the features of h(x,) generally fail to fully encompass those of the generated images Xg. Aligning with this, ConV effectively distinguishes natural and generated images by calculating feature similarity between the original and augmented images. This is consistent with the conclusion from Figure 7 showing the similarity between features of and (xx).
3.3 Discussion
When deploying detector to identify generated images, it crucial to consider practical environments or even a threat model. Specifically, images are often perturbed in practical scenarios, affecting detection performance. For instance, JPEG compression is common mechanism due to the spread of images on the Internet. Moreover, A Al-generated images may undergo proc-ssng to evade detection mechanisms. If detection method is sensitive to some perturbations, the vulnerability
8

---

AUROC (9
AUROC PS
Unn NPR
AUROC
NPR
NPR
(8)
(h)
(c)
Figure 8: Detection performance under various perturbations: a) JPEG compression, b) Gaussian
blur, and c) Gaussian noise.
would limit the applications in many practical scenarios. Thus, robustness to various perturbations is an essential metric in generated image detection. To verify the robustness of the proposed Con', we process both natural and generated images by introducing some degradation mechanisms. Unless otherwise stated, experiments are conducted on the ImageNet dataset.
Following previous works (Ricker et al., 2024), we evaluate the robustness of Con'V in three per- turbations, including JPEG compression (with quality q). Gaussian blur, and Gaussian noise (both with standard deviation r). As shown in Figure 8, ConV achieves the best performance. We find that training-free methods usually show better robustness than training-basee methods. Specifically, although NPR achieves promising results on clean images, its performance degrades drastically under perturbations. This may stem from its reliance on the relationship between pixels. Namely, various small perturbations can change its features, causing its performance to degrade drastically. In contrast, ConV leverages the generalization ability of the pre-trained self- supervseeee model and is robust under various perturbations, making it suitable for wider range of applications. Besides, we verify the efficacy of the proposed method using more pre-trained models with results in Appendix N. The results demonstrate that our method can be applied for various pre-trained models.
4 Related Works
Generated images detection. With the rapid advancements in generative models (Brock al., 2019), the generation of highly realistic images has become increasingly feasible, thereby creating an urgent demand for effective algorithms detect such generated images. Previous work (Frank et al., 2020) has usually focused on training a specialized binary classification neural network to distinguish between natural and generated images. CNNspot (Wang al., 2020) finds that with specific data augmentation, a standard image classifier trained on ProGAN is able to generalize other architectures. However, Ojha (Ojha al., 2023) shows that the generalizability does extend to unseen families of generative models. To this end, they propose to train classifiers in CLIP's representation space to obtain stronger generalisability. DIRE (Wang et al., 2023) uses the reconstruction eиror of an image on a diffusion model to train the classifier. However, training-bast bbaed approaches often suffer from generalizability issues and high computational costs. To address these limitations, several training- ffre methods have recently been proposed. AEROBLADE (Tan et al., 2024) performs the detection by calculating the reconstruction error with the autoencoder used in latent diffusion models (Rombach et al., 2022). However, understanding the underlying mechanisms that enable these approaches to perform well on images generated by unknown generative models remains challenging. On the contrary, our method explicitly maps how the generated images are detected. Thus, exhibiting good generalization performance on images generated by unknown models is in line with expectations. Fortunately, our experiments on images generated by Sora and OpenSora provide effective support, see Table 2.
Manifold learning. Manifold learning Cayton et al. (2008) assumes that real-world data presented high dimensional spaces are expected to concentrate the vicinity of a manifold M of much lower dimensionality, embedded in high dimensional space. Namely, the probability mass tends to concentrate regions with significantly lower dimensionality than the original space in which the data resides Bengio et al. (2013). In this context, tangent directions/spaces of the manifold. The tangent space of the manifold changes as the point-of-inters in Figure 3. The local tangent space at a point on the manifold can be considered locally valid transformations, i.e., transformed points are still on the data manifold. Intuitively, model is invariant to transformations along the tangent space Simard et al. (1991), which mathematically equal to the orthogonality between vectors from the tangent space and the gradient of the model's loss with respect to the input, i.c., Eq. 8.
moves on the manifold, as shown capturing

---

Conclusion
In this work, we propose ConV, a novel framework for detecting generated images. Unlike existing methods that rely heavily substantial datasets of natural and generated images, Conv relies solely on the natural image distribution. This is achieved by designing two functions whose outputs exhibit consistency for natural images but significant inconsistency for generated images. Extensive experiments on diverse benchmarks and images generated by a currently inaccessible model, i.e., Sora, have demonstrated ConV's superior performance.
Acknowledgments
JN and BH were supported by NSFC General Program No. 62376235, RGC Young Collaborative Research Grant No. C2005-24Y, RGC General Research Fund No. 12200725, Guangdong Basic and Applied Basic Research Foundation Nos. 2022A 1022151501100 1652 and 2024A
and HKBU CSD Departmental Incentive Scheme. XMT was supported by NSFC No. 62222117. MMG was supported by ARC 0P220102088 and WIS-MBZUAT 142571. I. KZ acknowledges the support from NSF Award No. 2229881, AI Institute for Societal Decision Making (AI-SDM), the National Institutes of Health (NIH) under Contract RO1 1L19880,, and grants from Quris AI, Florin Court Capital, and MBZUAI-WIS Joint Program. YGZ was funded by Inno HK Generative Al R&D Center.
References
Batifol, S., Blattmann, A., Boesel, F., Consul, S., Diagne, C., Dockhorn, T., English, J., English, Z., Esser, P., Kulal, S., et al. (2025). Flux. kontext: Flow matching for in-context image generation and editing in latent space. arXiv e-prints, pages arXiv-2506.
Bengio, Y., Courville, A., and Vincent, (2013). Representation learning: A review and new perspectives. IEEE transactions pattern analysis and machine intelligence,
Blattmann, A., Rombach, R., Ling, H., Dockhorn, T., Kim, S. W., Fidler, S., and Kreis, K. (2023). Align your latents: High-resolution video synthesis with latent diffusion models. In The IEEE/ CVF Computer Vision and Pattern Recognition Conference, CVPR.
Brock, A., Donahue, J., and Simonyan, K. (2019). Large scale GAN training for high fidelity natural image synthesis. In International Conference on Learning Representations, ICLR.
Caron, M., Misra, I., Mairal, J., Goyal, P., Bojanowski, P., and Joulin, A. (2020). Unsupervised learning of visual features by contrasting cluster assignments. In Advances in Neural Information Processing Destems,NeurPP,
Caron, M., Touvron, H., Misra, I., Jégou, H., Mairal, J., Bojanowski, P., and Joulin, A. (2021). Emerging properties in supervueee vision transformers. In /EEE/CVF International Conference on Computer Vision, ICCV.
Cayton, L. et al. (2008). Algorithms for manifold learning. eScholarship. University of California.
Chai, L., Bau, D., Lim, S., and Isola, P. (2020). What makes fake images detectable? understanding properties that generalize. In Proceedings of the European Conference on Computer Vision, ECCV.
Chen, B., Zeng, J., Yang, J., and Yang, R. (2024). DRCT: diffusion reconstruction contrastive training towards universal detection of diffusion generated images. In International Conference on Machine Learning, ICML.
Deng, J., Dong, W., Socher, R., Li, L., Li, K., and Fei-Fei, L. (2009). Imagenet: A large-scale hierarchical image database. In The IEEE / CVF Computer Vision and Pattern Recognition Conference, CVPR.
Dhariwal, P. and Nichol, A. Q. (2021). Diffusion models beat gans on image synthesis. In Advances in Neural Information Processing NeurPPS.
Dinh, I.,, Sohl-Dickstein, J., and Bengio, (2017). Density estimation using real NVP. In International Conference Learning Representations, ICLR.
10

---

Durall, R., Keuper, M., and Keuper, J. (2020). Watch your up copcolllot CNN based generative deep neural networks are failing reproduce spectral distributions. In The IEEE CVF Computer Vision and Puttern Recognition Conference, CVPR.
Frank, J., Eisenhofer, T., Schönherr, L.., Fischer, A., Kolossa, D., and Holz, T. (2020). Leveraging frequency analysis for deep fake image recognition. In International Conference on Machine Learning, ICML.
He, K., Fan, H., Wu, Y., Xie, S., and Girshick, R. B. (2020). Momentum contrast for unsupervised visual representation learning. In The IEEE / CVF Computer Vision and Pattern Recognition Conference, CVPR.
Jaderberg, M., Simonyan, K., Zisserman, A., and Kavukcuoglu, K. (2015). Spatial transformer networks. In Advances in Neural Information Processing Systems,Neur/PS,, pages 2017-2025.
Jeong, Y., Kim, D., Ro, Y., Kim, P., and Choi, J. (2022). Fingerprintnet: Synthesized fingerprints for generated image detection. In Proceedings of the European Conference Computer Vision, ECCV.
Karras, T., Laine, S., and Aila, T. (2019). A style-based generator architecture for generative adversarial networks. In The IEEE/ / CVF Computer Vision and Puttern Recognition Conference, CVPR.
Khachatryan, L., Movsisyan, A., Tadevosyan, V., Henschel, R., Wang, Z., Navasardyan, S., and Shi, H. (2023). Text2video-zero: Text-to-image diffusion models are zero-shot video generators. In IEEE/CVF International Conference on Computer Vision, ICCV.
Kingma, D. and Dhariwal, (2018). Glow: Generative flow with invertible 1x1 convolutions. In Advances in Neural Information Processing NeurlPS.
Liu, H., Tan, Z., Tan, C., Wei, Y., Wang, J., and Zhao, Y. (2024a). Forgery-aware adaptive transformer for generalizable synthetic image detection. In IEEE/CVF Conference on Computer Vision and Puttern Recognition, CVPR.
Liu, H., Tan, Z., Tan, C., Wei, Y., Zhao, Y., and Wang. J. (2024b). Forgery-aware adaptive transformer for generalizable synthetic image detection. The IEEE CVF Computer Vision and Pattern Recognition Conference, CVPR.
Liu, Z., Lin, Y., Cao, Y., Hu, H., Wei, Y., Zhang, Z., Lin, S., and Guo. B. (2021). Swin transformer: Hierarchical vision transformer using shifted windows. In IEEE/CVF International Conference on Computer Vision, ICCV.
Liu, Z., Qi, X., and Torr, P. H. (2020). Global texture enhancement for fake face detection in the wild. In The IEEE / CVF Computer Vision and Pattern Recognition Conference, CVPR.
Mandelli, S., Bonettini, N., Bestagini, P., and Tubaro, S. (2022). Detecting gan-generated images by orthogonal training of multiple cnns. International Conference on Image Processing, ICIP.
Ojha, U., Li, Y., and Lee, J. (2023). Towards universal fake image detectors that generalize across generative models. The IEEE / CVF Computer Vision and Pattern Recognition Conference, CVPR.
OpenAl (2024). Sora: Creating video from text.
Oquab, M., Darcet, T., Moutakanni, T., Vo, H. V., Szafraniec, M., Khalidov, V., Fermandez, P., Haziza, D., Massa, F., El-Nouby, A., Assran, M., Ballas, N., Galuba, W., Howes, R., Huang, P., Li, S., Misra, I., Rabbat, M., Sharma, V., Synnaeve, G., Xu, H., Jégou, H., Mairal, J., Labatut, P., Joulin, A., and Bojanowski, P. (2024). Dinov2: Learning robust visual features without supervision. Trans. Mach. Learn. Res.
Qian, Y., Yin, G., Sheng, L., Chen, Z., and Shao, J. (2020). Thinking in frequency: Face forgery detection by mining frequency-aware clues. In Proceedings of the European Conference on Computer Vision, ECCV.
11

---

Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishknn, P., Clark, J., Krueger, G., and Sutskever, (2021). Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, ICMI..
Ricker, J., Lukovnikov, D., and Fischer, A. (2024), AEROBLADE: training-free detection of latent diffusion images using autoencoder reconstruction error. In The IEEE/ CVF Computer Vision and Patter Recognition Conference, CVPR.
Rifai, S., Dauphin, Y. N., Vincent, P., Bengio, Y., and Muller, X. (2011). The manifold tangent classifier. Advances in neural information processing systems, 24.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. (2022). High-resolution image synthesis with latent diffusion models. The IEEE/ CVF Computer Vision and Pattern Recognition Conference, CVPR.
Shiohara, K. and Yamasaki, T. (2022). Detecting deepfakes with self-blended images. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference, CVPR.
Shumailov, L., Shumaylov, Z., Zhao, Y., Papernt, N., Anderson, R. J., and Gal, Y. (2024). Al models collapse when trained recursively generated data. Nature.
Simard, P., Victorri, B., LeCun, Y., and Denker, (1991). Tangent prop-a formalism for specifying selected invariances in an adaptive network. Advances in neural information processing systems, 4.
Stein, G., Cresswell, J. C., Hosseinzadeh, R., Sui, Y., Ross, B. L., Villecroze, V., Liu, Z., Caterini, A. L., Taylor, J. E. T., and Loaiza- Loaiza-Ganem, G. (2023). Exposing flaws generative model evaluation metrics and their unfair treatment of diffusion models. In Advances in Neural Information Processing Systems, Systems,NeurIPS. NeurIPS.
Tan, C., Liu, H., Zhao, Y., Wei, S., Gu, G., Liu, P., and Wei, Y. (2024). Rethinking the up-sampling operations in enn-based generative network for generalizable deepfake detection. In The IEEE CVF Computer Vision and Pattern Recognition Conference, CVPR.
Tan, C., Zhao, Y., Wei, S., Gu, G., and Wei, Y. (2023). Learning on gradients: Generalized artifacts representation for gan-generated images detection. In The IEEE CVF Computer Vision and Pattern Recognition Conference, CVPR.
Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., and Jégou, H. (2021). Training data-efficient image transformers & distillation through attention. In International Conference on Machine Learning, ICML.
Wang, S., Wang, O., Zhang, R., Owens, A., and Efros, A. A. (2020). Can- Cnn-generated images surprisingly easy to spot... for now. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference, CVPR.
Wang, 7., Bao, J., Zhou, W., Wang, W., Hu, H., Chen, H., and Li, H. (2023). DIRE for diffusion- generated image detection. In IEEE/CVF International Conference on Computer Vision, ICCV.
Yang, Z., Xu, Q. Bao, S., Wen, P., He, Y., Cao, X., and Huang, Q. (2023). Auc-oriented domain adaptation: From theory to algorithm. IEEE Transactions on Pattern Analysis and Machine Intelligence.
Yu, F., Zhang, Y., Song, S., Seff, A., and Xiao, J. (2015). LSUN: construction of large-scale image dataset using deep learning with humans in the loop. CoRR.
Yu, H., Qin, Z., Hou, J., Saleh, M., Li, D., Busam, B., and Ilic, S. (2023). Rotation-invarian transformer for point cloud matching. In The IEEE/ EVF Computer Vision and Pattern Recognition Conference, CVPR.
Zhang, X., Karaman, S., and Chang, S. (2019). Detecting and simulating artifacts in GAN fake images. In International Workshop on Information Forensics and Security, WIFS.
Zheng, 7., Peng, X., Yang, T., Shen, C., Li, S., Liu, H., Zhou, Y., Li, T., and You, Y. (2024). Open-sora: Democratizing efficient video production for all.
12

---

Zhu, M., Chen, H., Huang, M., Li, W., Hu, H., Hu, J., and Wang, Y. (2023a). Gendet: Towards good generalizations for ai- ai-generated image detection, arXiv preprint 2xxv:23/2.08880.
Zhu, M., Chen, H., Yan, Q. Huang, X., Lin, G., Li, W. Tu, Z., Hu, H., Hu, J., and Wang, Y. (2023b). Genimage: A million-scale benchmark for detecting ai-generated image. In Advances in Neural Information Processing NeurlPS.
13

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes],
Justification:
The main claims made in the abstract and introduction accurately reflects the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer:
[Yes],
Justification:
Limitations are discussed in Appendix B.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
14

---

Justification:
The paper provides a full set of assumptions and complete proof.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The paper fully discloses the information needed to reproduce the main experimental results.
Guidelines:
The answer NA means that the paper does include experiments. If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
15

---

Answer: [Yes]
Justification:
The data and code will be released once prepared.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (uttps://nipp cc/
httpl//gguides//oeeSStieeee sonooesoss for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: /Co///eooeeeeeeeeeee
/ /nips wwtppbccc//aaeeccccccccccccc Cotiei/uaiieeeeeeeumiiiiii wwsssssoiicciioosooo for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification:
The paper provides details of implementation in Appendix F.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We report the average results under five different random seeds and report the variance in Figure 5.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
16

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative enror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The paper provide sufficient information on the computer resources.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https: ctttpa//neurrpsl cc httpppliic/tticsauuiieieieeeeeee http://rrppppppepppaaaaaeeeeeeea innes?
Answer: [Yes]
Justification: The research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
The paper has discussed societal impacts in Appendix A.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
17

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA].
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We have cited the original paper that produced the code package and dataset.
Guidelines:
The answer NA means that the paper does
existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
18

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
We communicate the details of the code as part our submission via structured templates.
Justification:
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]
Justification:
The paper does not involve crowdsourcing and research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing and research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such the institution conducting the review.
19

---

16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does not involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: //ttrr//s....eeeeeeeee eeeeurips.cc/ooffeeeeee for what should or should be described.
20

---

A Social impacts
The proposed Al-generated image detection framework substantially mitigates societal risks stemming from the misuse of generative models. By advancing the capability to detect synthetic media, such as deepfakes. this work strengthens efforts combat disinformation and enhances trust in digital media across critical domains, including journalism and legal evidence.
B Limitation
Limitation. 1) Although the proposed orthogonal principle provides approach for designing various types of functions and its validity is widely supported by extensive empirical studies, we have not provided formal proof of the convergence of the generalization risk within the context of generated image detection. Thus, our future work will focus on establishing the theoretical foundations of the generalization of our approach. 2) Although of detectors, we have not provided an aggressive scenario where generative models are trained to minimize the inconsistency between fi and f2 fi h. Thus, we will investigate the potential of integrating effective, robust, and efficient detection methods into the training process of generative models make the generated images more realistic. 3) Despite numerous empirical studies validating the effectiveness of the proposed Con V, the impact of scaling up the self-supervised model on the performance of detecting generated images remains be explored since collecting larger dataset and training an expanded self-supervised model are beyond the scope of this study. Moreover, future work needed to explore how the performance of ConV will be affected self-supervised models are trained on generated images. Finally, given the ongoing evolution of generative models, integrating advanced Domain Adaptation techniques (Yang et al., 2023) with Con appears promising.
consider a threat model verify the robustness
C Derivation for Inconsistency
Here, we give the detailed derivation of Eq. 4. We expand these two functions at x == XM(Xx)) for given generated image Xg:
(x,)) (x) fx( x), f2(x,) f2(x) V12(x) x). (16)
where we neglect the higher-order approximation error.
The inconsistency between generated images can be formalized by,
8(x,) ) ( (x) V/2(x)) (
=
-x)= (17)
where the equation holds because of 6(x) = fi f2(x) Then, we have
6 (x,)) = (V - (22(x)) (xg x)1 2 (x) ((x, - x) V222() -x)1- (18)
D SOFTWARE AND HARDWARE
We use python 3.8.16 and Pytorch 1.12.1, and seveal NVIDIA GeForce RTX-3090 GPU and NVIDIA GeForce RTX-4090 GPU.
E Details of transformations
We follow the data augmentation strategy used when training DINOv2 with a combination of HorizontalFlip. ColorJitter, and GaussianBlur. For ColorJitter, brightness, contrast, saturation, and hue are randomly adjusted with factor in the ranges of [0.88, 1.11... 1.000,,7,1.033, respectively. For GaussianBlur, the kernel size is set to 9x9, and the variance is randomly selected in [0.7.1].
F Implementation Details
To maintain detection efficiency, we set n 20 in our experiments. For F-ConV, we train RealNVP (Dinh et al., 2017) on the top of DINOv2 ViT-L/14, which consists of 2 coupling blocks
21

---

Table 3: Al-generated image detection performance on ImageNet.
Motols
ATM
ARMN
1BM
EXT
BigGAN
GigrAN
SylaGAN
RO-Tonnderrer
Rankon mosion Vedegiee
70.13
86-05
6510
65
26.66
76
11:11
73.85
11.38
TEW
with fully connected networks as internal functions. The model is optimized using the AdamW optimizer with a learning rate of 1 x 10 " 31 = 0.9, 82 = 0.99, and a weight decay of 0.01. Following CNNspot (Wang et al., 2020), data augmentation techniques, including JPEG compression and Gaussian blur, are applied to enhance model robustness. For the ImageNet and LSUN-Bedrood benchmarks, the ProGAN dataset is used as the training set. For the GenImage benchmark, the SDv1.4 1. dataset is employed as trainind set and the SDv2 dataset serves as the training set for the DRCT-2M benchmark. During testing, ensure unbiased classification accuracy and mitigate biases from manually selected thresholds, we follow (Ojha et al., 2023) by automatically determining the optimal threshold. This threshold is selected to maximize the separation between natural and synthetic images based on their classification scores. An alternative approach involves optimizing the threshold on a small validation set. This method's ' performance is sensitive to the validation set's characteristics, such its size and distributional representativeness. However, in real-world applications, the methods for determining thresholds may vary. For instance, to prioritize the detection of generated images, administrators may set higher threshold, classifying only samples with similarity scores approaching I as natural images. This is consistent with the motivation of leveraging AUROC and AP as the main metric for evaluation.
G Details of Datasets
IMAGENET,
The natural images and generated images can obtained hattps://g/ thub. com/ layer6ai-labee hasps/dmmaaallaa eval. The images are provided by (Stein et al., 2023). The resolution of natural images and generated images are 256 256. The generated images include: ADM, ADMG, BigGAN, DiT-XL-2, GigaGAN, LDM, StyleGAN-XI, RQ- Tr-nrnssform,r, Mask-GIT
The natural images and generated images can be obtained httts:///gtthhhha com/layer6ai- labsllaabbaaaaa dgm- eval. The images are provided by (Stein et al., 2023). The resolution of natural images and generated images are 256 256. We crop the image randomly to 224 224 resolution. The generated images include: ADM, DDPM, iDDPM, StyleGAN, Seffuuiion-rooectte GAN, Projected GAN, Unleashing Transformers.
LSUN-BEDROOM
dgm-eval.
GenImage. The natural images and generated images can be obtained at buttps//githii com/ GenImage SaetiaggeDDttase.... Dataset Ceeaaset/Gennmaae Image. The images provided by (Zhu al., 2023b). The natural images come from ImageNet, and different images have different resolutions. The generative model includes Midjourney, SD V1.4, SD V1.5, ADM, GLIDE, Wukong, VQDM, and BigGAN.
DRCT-2M. The natural images DRCT-2M come from CoCo and can obtained from https: //cocoattaset. org/#dowmload. Al-generated images of DRCT-2M can be obtained from https: //modelscope. cn/ cn/datasets/ httpert//oooiinneeenneeeee CDRCCChhhenn/---eeee Ht/p//DCCTTMDRMDDE 2Mffiles, which are provided by (Chen et al., 2024). The generative model includes LDM. SDv 1.4, SDv1.5, SDv2, SDXL. SDXL-Refiner, SD- Turbo, SDXL-Turbo, LCM-SDv1.5, LCM-SDXL, SDv1-Ctrl, SDv2-Ctrl, SDXL-Ctrl, SDv1-DR, SDv2-DR, SDXL-DR.
H Results of using other data transformations.
In our experiments, we leverage data augmenta- tions used in the training phase, including geo- metric augmentations, color jitter, and Gaussian blur. We further conduct comparison experi- ments using data augmentations which is not used during training, such as random rotation. The experiments are conducted on the ImageNet
Table 4: Ablation studies on F-ConV.
Method
AUROC
AP
F-ConV
93.77
93.38
w/o Shaping Loss
89.
87.89
w/o Consistency Loss
92.54
91.66
benchmark. As shown Table 3, using data transformations not seen during training does not result in
22

---

Table 6: Al-generated image detection performance on ImageNet.
Motolo
ATM
ATMA
1IM
TNT
BigFANN
GighTAN
StyIGAN XL
Mast GIT
Trassrg- Foued Millica
Obs
$3.37
82333
73:00
78.13
$6.35
79.31
$2.33
57.45
$4.85
85.36
13.3
55 19
$4.22
91.2
96.71
$5.35
14.23
TIRS
Tranng fee Machoda
CiN- DDNO
$8.59
06.89
12.46
79.83
18.04
75.85
15.25
70.11
92.83
92.05
91.89
56.33
92.15
91.82
93.00
1..36
08
57.85
85.13
85.55
CulI-CLPP anssochd
75.64
76.32
08.3
10.29
T00a
09.75
T6.93
70.23
72.57
13/05
70.52
76.35
71.23
A0
72.05
75.30
72.09
13,08
good detection performance. Since rotations were not used data augmentation during training, using them to perform ConVV during testing could not achieve good detection performance.
I Ablation studies the transformation functions
As shown in Table 5, we conduct additional ablation studies evaluating the effectiveness of various transformation functions. The results indicate that the three transformations examined exhibit comparable performance.
J Ablation studies on F-ConV
As shown in Table 4, we perform ablation exper- iments on the two loss functions used in F-ConV. The results validate the effectiveness of our ap- proach.
Table 5: The effect of transformation functions.
Model
AUROC
AP
ConV
87.13
85.15
w/o HorizontalFlip
86.55
84.19
K
Analysis of Failure Cases
w/o ColorJitter
85.97
83.74
w/o GaussianBlur
85.49
82.83
As shown in Figure 9, we demonstrate some failure cases ConV. We compute the original features and transformed features highly real- istic generated images. can be observed that the features of these highly realistic generated images also remain virtually unchanged, leading the model incorrectly classify them natural images.
L Results on CLIP
DINOv2 for all of experiments. We further use CLIP for comparison experiments. We note that the au- thors only used randomly crop data augmentation when training CLIP. Therefore, when implementing Con with CLIP, we also only random crop. As shown in Table 6, using CLIP to im- plement Con V does not achieve good performance. We speculate that this difference comes from the training methodology. CLIP learns features using image captions as supervision, which may make the features more focused semantic information, whereas DINOv2 learns features only from images, which makes more focused on the images themselves, and thus better able capture the subtle differences between the natural image and the generated image. In addition to this, the fact that CLIP only uses random crop as data augmentation may also contribute the poor performance of ConV.
In paper,
Figure 9: ConV fails on highly realistic generated images.
The results show that our method performs relatively worse when using CLIP. To overcome this limitation, revisit our methodology, i.e., verifying the consistency between outputs of two functions.
As shown in Eq. (13), we derive the cosine similarity metric between image features from self- supervised learning objective function. However, CLIP employs calculating the similarity between text and image features. Thus, the proposed cosine similarity
employp a different objective function, namely,
23

---

between image features may not be good realization of these two functions' output, limiting the generalization capability for generated image detection. We conjecture the difference between the projection of the visual features of the original image and the visual features of the transformed image on their corresponding text features would be good metric. The reason is as follows: The function to calculate the similarity between text and image features can be regarded as function. Thus, we should calculate the difference in inter-modaat moder-modality similarity rather than the similarity between original and transformed images. To verify the point, we conduct experiments using the corrected realization of fi and f2, i.e., a corrected metric to verify the consistency. The results below show that the modified approach outperforms the original metric.
These results show that using the modified metric for detection greatly improves the performance of CLIP-based methods model, achieving performance comparable with Dinov2- Dinov2-based methods. Hence, we believe our work provides a novel approach calculating the difference between two functions without focusing on the differences in similarities between two image features.
M Results on GenImage, DRCT-2M and LSUN-BEDROOM
As shown in Table 7, Table 9 and Table 8, our method achieves good performance on Genlmage, DRCT-2M and LSUN-BEDROOM, confirming the robustness of the proposed method.
Table 7: Al Al-generated image detection performance (ACC, %) on GenImage.
Models
Methods
Midjoumey SD V1.4 SD V1.5
ADM GLIDE Wukong VQDM BigGAN Average
Training Methods
ResNeet-50
54.9
99.9
99.7
53.5
61.9
98.2
56.6
$2.0
72.1
DeiT-S
55.6
99.9
99.8
49.8
58.1
98.9
56.9
53.5
71.6
Swin-T
62.1
99.9
99.8
49.8
67.6
99.1
62.3
57.6
74.8
CNNspot
52.8
96.3
95.9
50.1
39.8
78.6
53.4
46.8
64.2
Spec
52.0
99.4
99.2
49.7
49.8
94.8
55.6
49.8
68.8
F3Net
50.1
99.9
99.9
49.9
50.00
99.9
49.9
49.9
68.7
GramNet
54.2
99.2
99.1
50.3
54.6
98.9
50.8
51.7
69.9
DIRE
60.2
99.9
50,9
55.0
99.2
50.1
50.2
70.7
Ojha
73.2
84.2
84.0
55.2
76.9
75.6
56.9
80.3
73.3
NPR
81.0
98.2
97.9
76.9
89.8
96.9
84.1
84.2
88.6
FatFormer
92.7
100.0
99.9
75.9
88.0
99.9
98.8
55.8
88.9
GenDet
89.6
96.1
96.1
58.0
78.4
92.8
66.5
75.0
81.6
DRCT
91.5
95.0
94.4
79.4
89.1
94.6
89.4
F-Conv
89.3
98.8
98.5
74.9
89.3
95.6
86.7
87.6
90.1
Training-
Methods
AEROBLADE
80.3
87.5
86.8
67.2
81.5
83.7
51.1
$2.5
73.83
ConV
85.13
76.74
74.53
73.80
72.97
80.00
87.57
89.94
80.08
Table 8: Detection performance (%) on LSUN-Bedroom
ADM
DDPM
IDDMM
Diffision GAN
Projected GAN
StyleGAN
Unleashing Transurmer
Average
AUROC
AP
AUROC
AP
AUROC
AP
AUROC
AP
AUROC
AP
AUROC
AP
AUROC
AP
AUROC
AP
CNNspot
64.83
64.24
79.04
30.58
76.95
76.25
38.45
87.19
90,80
39.94
95.17
90.94
93.42
93:11
$4.09
83.75
Ojha
71.26
70.35
79.26
78.27
74,80
73.46
84.56
82.91
$2.00
78.42
81.22
78.08
83.5%
K3.48
79.53
77.94
DIRE
$7.19
56.85
61.91
61.35
59.83
58.29
53.18
53.48
55.35
$4.93
57.66
56.90
67.92
68.33
59.00
58.
NPR
75.43
72.60
91.42
90.89
89.49
38.25
76.17
74.19
75.07
74.59
68.82
63.53
$4.39
83.67
30.11
78.25
F-ConV
76.59
74.40
93.53
92.16
88.90
86.85
98.10
98.03
97.93
97.81
91.63
90.16
97.31
96.91
92.00
90.91
AFROBLADA
57.05
58.37
61.57
61,49
59.82
61.36
47.12
48.25
45.95
46.11
45.63
47.06
59.71
$7.34
$3.85
54.25
Con'V
73.71
71.52
87.74
36.99
$2.95
$1.79
93.79
93.87
94.73
91.74
$4.10
$2.35
93.75
93.51
87.25
86.34
Table 9: Al-generated image detection performance (ACC, %) on DRCT-2M.
Turbo Viriants
ContmiNet Variett
Verants
Avg.
LCM-
SD$1.5
SUXL
CNNSSpot
59.87
59.91
59
57.65
65.33
86.55
36.11
12.42
98.25
61:72
97.96
55.89
$2.94
60.95
51.41
50125
81.12
FiNet
99.85
99.78
99.27 70
58.60
55.85
87:97
65:39
51.66
97:3 17:99
54.98
97.98
12.90
$1.90
65.42
50.30
50.21
71.13
CLIPRNNO
99.20
99.59
99.96
94.61
62.08
91.43
$4.40
$4,10
98.97
$7.43
99.74
$0.69
82.02
65.83
50.67
50.47
90.05
GranzNer
99.40
99.01
98.84
95.30
62.63
30.68
71.19
58.32
93.05
$7.02
39.97
75.25
82.65
$1.25
50.01
50.05
76.62
De fale
92.1
95.35
99.51
59.05
64.022
69.24
92.00
93.99
99.1
70.89
$2.95
62.34
65.65
50.12
50.16
50.00
75.52
Com--B
59.07
100.0
99.07
05.84
64.44
82:00
60:75
99.27
99.27
62.35
59.80
$3.40
75.25
65
$1.70
$0.43
76.11
Odtaa
98.30
96:22
96.33
93.83
91.01
03.91
$6.30
$3.02
90.44
$9.99
90.41
$1.06
89.06
$1.96
$1.03
50.45
83.46
DIMP:
$4.62
75.04
59.87
59.00
9505
K7.19
72.53
67.35
49.92
71.55
DRITT
34
95.05
96. 41
66
99.86
67.61
FatFoontee
92.97
91.78
92.92
91.76
60.15
55.13
CooN
73.17
82.00
89.53
17.92
77.15
77.67
76.54
CO
99.15
95.75
99.50
97.66
95.55
98.99
93.63
24

---

Table 10: generated image detection performance with different pre-trained models.
Models
MoCo
SWAV
DINO
CLIP
DINOv2
Methods
AUROC
AP
AUROC
AP
AUROC
AP
AUROC
AP
AUROC AP
Con'V
68.43
67.65
74.71
73.48
71.91
69.46
72.99
72.98
87.13
85.15
N
Result more pre-trained models
Besides CLIP, we conduct experiments using the MoCo (He et al., 2020), SwAV (Caron et al., 2020), and DINO (Caron al., 2021). The results are reported Table 10. These results show that our method can be applied to various backbones.
Table 11: Experimental results on Flux.
Method
AUROC
AP
ConV F-ConV
87.38 90.18
89.19
90.65
Experimental results on Flux
To further assess the generalization capabilities of Con', evaluate its performance against the advanced FLUX.1 [dev] generative model (Batifol et al., 2025), which was not encountered during training. For this analysis, a new benchmark dataset is constructed, comprising 6,000 images generated by FLUX.1 [dev] and an equal number of natural images sampled from ImageNet. As presented in Table 11, ConV demonstrates robust performance on this unseen model, underscoring the strong cross-model generalizability of our approach.
P Comparison with Linear Classifiers
To further demonstrate effectiveness of our approach, we additionally train binary classifier on the DINOv2 embeddings using the same training set. As shown in Table 12, the performance of the directly trained binary classifier falls short of that achieved by F-ConV, highlighting the advantage of manifold-bass approach.
Table 12: Comparison with Linear Classifiers.
Method
AUROC|
AP
Con'V
87.38
89.19
F-ConV
90.18
90.65
Linear classification
87.83
86.49
25


Reviews:
[{"review_id": "aPMIL75o3R", "reviewer": "Reviewer_3bZe", "summary": "This paper presents ConV, a training-free framework for detecting generated images by exploiting the geometric inconsistency between natural and synthetic image manifolds. The key insight is that natural images maintain feature consistency under small, manifold-preserving transformations, while generated images exhibit notable representation shifts. By comparing features of an image and its augmented version using a pre-trained vision backbone (e.g., DINOv2), ConV effectively distinguishes real from fake content. To further enhance performance, F-ConV extends this framework with a flow-based manifold extrusion mechanism: using normalizing flows, it reshapes the complex natural image distribution into a Gaussian space, enabling explicit separation from generated content. Extensive experiments show that ConV performs on par with or better than many training-based baselines, especially under distribution shifts and on unseen generative models (e.g., Sora). Visualizations with t-SNE and cosine similarity confirm that natural images retain stable representations, while generated images deviate significantly after transformation, validating the core assumption behind ConV.", "questions": "1. How sensitive is the method to the choice of the transformation function $h(\\cdot)$? Are some augmentations more effective than others?\n2. Can the authors provide empirical validation for the assumption that the gradients lie in orthogonal subspaces for natural vs. generated images?\n3. How does the detection performance change if a smaller or weaker self-supervised backbone is used instead of DINOv2?\n4. Could the authors provide ablation studies isolating the shaping and consistency losses in F-ConV?\n5. How is the performance better than a simpler setup where we train an autoencoder over training images and detect generated images if the loss is higher than a threshold?", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "**Strenghts**\n* The use of normalizing flows is well-motivated and novel. The proposed F-ConV framework introduces a principled use of normalizing flows to map natural image features into a Gaussian latent space. This invertible transformation allows generated images to be effectively extruded from the natural image manifold, amplifying their separability. The design is both novel and technically sound, improving the core ConV framework.\n* The proposed method demonstrates strong generalization to unseen generative models. ConV shows robustness on evaluations with real-world video frames generated by black-box models, i.e., Sora and OpenSora. These results highlight the method's ability to handle significant distribution shifts and unseen generative sources without requiring re-training or domain adaptation, which is a very important property in real-world scenarios.\n* Insightful visualizations supporting intuition. t-SNE visualizations are provided that illustrate feature (in)consistency under data transformations. These plots provide evidence for the underlying mechanism and the core idea of the paper, i.e., that natural images exhibit consistent representations under manifold-preserving transformations, whereas generated images do not. This strengthens the paper's clarity and helps understand the behavior of the method.\n\n**Weaknesses**\n1. Assumption of orthogonal gradient subspaces lacks empirical validation. A core idea for the method is that gradients with respect to two designed functions lie in orthogonal subspaces for natural vs. generated images. While this is sound, it is not empirically validated. This leaves a gap between the method's theoretical motivation and empirical evidence.\n\n2. Generalization with other backbones is not assessed. While the method achieves strong results using DINOv2, it remains unclear how sensitive ConV is to the choice of backbone. There is limited investigation into how the method would perform with weaker or less recent self-supervised models. This raises concerns about the generality of the method and the transferability of conclusions to other cases, especially in scenarios where DINOv2 is unavailable or too resource-intensive.\n\n3. F-ConV loss components are not ablated. The F-ConV extension introduces a loss combining manifold shaping and consistency terms. However, no clear ablation study is provided to disentangle the contribution of each component. It is not clear how much each term contributes to the performance gain, limiting insight into the effectiveness and necessity of the loss design.\n\n4. No analysis of failure cases is provided. Although the method shows strong empirical results, no discussion of failure cases is provided. For example, high-quality generated images that preserve feature consistency under transformation, or natural images degraded by noise or low-light conditions, may challenge the method's assumptions. Understanding when and why the method fails would be valuable for improving robustness.\n\n5. The heavy mathematical formalism might limit accessibility. The core ideas, i.e., leveraging manifold geometry, enforcing gradient orthogonality, and detecting inconsistency under transformation, are insightful; however, the presentation is mathematically dense, with technical details involving Jacobians, projections, and flow-based latent space transformations. This level of formalism may make it difficult for the broader audience to grasp the main intuition of the paper.", "was_revised": true, "final_justification": "The authors have addressed all of the reviewer’s concerns. To this end, the reviewer is raising the original rating.", "rebuttal": "We are truly grateful for the reviewers' dedicated efforts. The valuable comments greatly improve the quality of our work. We provide the following answers to the reviewers' concerns.\n\n\n> Q1. Assumption of orthogonal gradient subspaces lacks empirical validation. Can the authors provide empirical validation for the assumption that the gradients lie in orthogonal subspaces for natural vs. generated images?\n\nThanks for your constructive feedback! The mentioned results would provide a straightforward approach to verify the effectiveness of our method, thereby significantly improving the quality of our work. We will provide the complete empirical validation results during the discussion period.\n\n\n> Q2. Generalization with other backbones is not assessed. How does the detection performance change if a smaller or weaker self-supervised backbone is used instead of DINOv2?\n\n\nWe express our gratitude for the reviewer’s insightful comment. To further substantiate the efficacy of our proposed method, we conducted additional experiments using various backbone models, including MoCo, SwAV, DINO, CLIP, and SigLIP. The experimental results, presented in the table below, demonstrate that ConV maintains robust detection performance even when applied to less powerful models.\n\n|                             | AUROC | AP    |\n|-----------------------------|-------|-------|\n| MoCo                      | 68.43 | 67.65 |\n| SwAV     |   74.71   |  73.48     |\n| DINO |    71.91   |  69.46     |\n|CLIP| 72.99|72.98|\n|DINOv2|87.13|85.15|\n|SigLIP|84.19|81.93|\n\n\n> Q3. F-ConV loss components are not ablated. Could the authors provide ablation studies isolating the shaping and consistency losses in F-ConV?\n\n\nThanks for your constructive suggestion. We further conducted ablation experiments on this. The experimental results are shown in the table below.\n\n|                             | AUROC | AP    |\n|-----------------------------|-------|-------|\n| F-ConV                      | 93.77 | 93.38 |\n| F-ConV w/o Shaping Loss     |   89.17   |  87.89     |\n| F-ConV w/o Consistency Loss |    92.54   |    91.66   |\n\n> Q4. No analysis of failure cases is provided.\n\nWe express our gratitude for the reviewer’s valuable suggestion. In the revised manuscript, we incorporate an analysis of failure cases as recommended. Our findings indicate that highly realistic generated images typically exhibit minimal feature variations pre- and post-transformation, resulting in misclassification.\n\n> Q5. The heavy mathematical formalism might limit accessibility. \n\nWe express our appreciation for the reviewer’s valuable suggestion. In the revised manuscript, we incorporate more detailed and precise explanations to enhance clarity and accessibility.\n\n\n> Q6. How sensitive is the method to the choice of the transformation function $h(\\cdot)$? Are some augmentations more effective than others?\n\nWe thank the authors for the valuable suggestions. To address the query regarding the sensitivity of our method to the choice of transformation function $h(\\cdot)$, we conducted additional ablation studies evaluating the effectiveness of various transformation functions. The results, presented in the table below, indicate that the three transformations examined exhibit comparable performance.\n\n|                         | AUROC | AP    |\n|-------------------------|-------|-------|\n| ConV                    | 87.13 | 85.15 |\n| ConV w/o HorizontalFlip | 86.55 | 84.19 |\n| ConV w/o ColorJitter    | 85.97 | 83.74 |\n| Conv w/o GaussianBlur   | 85.49 | 82.83 |\n\n\n> Q7. How is the performance better than a simpler setup where we train an autoencoder over training images and detect generated images if the loss is higher than a threshold?\n\nWe express our appreciation for the reviewer’s insightful comment. The approach highlighted, a well-established method in anomaly detection, leverages reconstruction loss through autoencoders. These models are typically trained on normal samples, enabling effective reconstruction of in-distribution data but yielding higher reconstruction errors for anomalous samples. However, in the context of AI generated image detection, the diverse distributional characteristics of natural images necessitate training an autoencoder on an extensive dataset, such as the LVD-142M dataset employed in DINOv2, to adequately capture the natural image distribution. Due to resource and time constraints, training an autoencoder on such a large-scale dataset is infeasible within the scope of this study, precluding a fair comparison with this method."}, {"review_id": "9LjGUIP2tQ", "reviewer": "Reviewer_5UgF", "summary": "This paper proposes a method for detecting generated images. It proposes two versions: ConV, a fully training-free approach that compares the feature similarity of an image and its transformed versions. If they are dissimilar, an image is likely generated. Another version is F-ConV, which supplements ConV by training a normalizing flow model that separates the natural and generated image manifolds, and the decision is made by additionally considering the likelihood under this model. Experiments compare ConV and F-ConV with a variety of baselines on various datasets and scenarios, and results show that the proposed methods attain consistent and strong performance.", "questions": "Decision threshold selection in practice:\n* L542 mentions that the decision threshold is selected automatically to maximize the separation between natural and generated images. Is this performed per-domain/dataset or generally across all datasets/domains? \n* Related to this, how does the cosine similarity distribution for natural vs. generated images compare across domains and datasets? Are there cases where similarities for generated images of one dataset are higher than those of natural images of another dataset? If this is the case, in practical, generic situations where natural images encompass all non-generated images, and synthetic images can come from any model with any training data, how should the decision threshold be decided? \n\nAblation on data transformation: \n* While it is intuitive to use the same transformations as those used in the feature extractor’s training, are there any empirical analysis to determine if all of them are truly necessary, or are specific ones that contribute more and would suffice (holding the number of transformations constant)?", "limitations": "Yes the authors have discussed potential limitations.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n* The proposed methods are well-motivated, intuitive and straightforward. \n* Evaluations are extensive, covering diverse datasets, corruption scenarios and baselines. \n* Results show that the proposed methods achieve strong and consistent performance. The training-free version ConV attains comparable performance to various training-based methods, and the training version F-ConV attains competitive performance over existing methods.\n\nWeaknesses:\n* The performance is sensitive to the choice of feature extractor. Using smaller DINOv2 models (L269) or other types of feature extractors (supp. Table 8) as the backbone leads to significantly reduced performance.\n* Additional clarifications can be made regarding decision threshold selection and ablation on transformations (see Questions below).", "was_revised": true, "final_justification": "Thank the authors for the rebuttal. I am satisfied with the response and decide to keep my score of borderline accept.", "rebuttal": "We are truly grateful for the reviewers' dedicated efforts. The valuable comments greatly improve the quality of our work. We provide the following answers to the reviewers' concerns.\n\n\n> Q1. The performance is sensitive to the choice of feature extractor.\n\nWe express our gratitude for the reviewer’s insightful comment regarding the sensitivity of our method to the choice of feature extractor. As ConV operates without additional training and relies solely on a pre-trained feature extractor, its performance hinges on the extractor’s ability to maintain a precise balance: effectively capturing the characteristics of natural images while avoiding overgeneralization to generated images. This results in ConV being sensitive to the feature extractor used. However, this sensitivity can be mitigated through fine-tuning the feature extractor, as evidenced by the results presented in the table below.\n\n|                        | AUROC | AP    |\n|------------------------|-------|-------|\n| ConV DINOv2 ViT-L/14   | 87.13 | 85.15 |\n| ConV CLIP ViT-L/14     |  72.99  | 72.98      |\n| ConV DionV2-vit-b      |   78.58    | 76.39      |\n| F-ConV DINOv2 ViT-L/14 | 93.77 | 93.38 |\n| F-ConV CLIP ViT-L/14   |   94.25  |  94.11   |\n| F-ConV DINOv2 ViT-B/14 |   89.17    |  88.54     |\n\nThanks again for your inspiring comments. We have added the above results to our revision.\n\n\n> Q2. L542 mentions that the decision threshold is selected automatically to maximize the separation between natural and generated images. Is this performed per-domain/dataset or generally across all datasets/domains?\n\nThanks for pointing out this potentially confusing description issue. We have added the following explanations to our revision.\nTo optimize overall accuracy, we can establish the classification threshold at a value that maximizes the distinction between natural and generated images. However, in real-world applications, this approach may differ. \n\nFor instance, to prioritize the detection of generated images, administrators may set a higher threshold, classifying only samples with similarity scores approaching 1 as natural images. This is consistent with the motivation of leveraging AUROC and AP as the main metric for evaluation.\n\nRegarding the threshold of accuracy, we used the training set from GenImage to select a threshold and applied that threshold to all test sets. As shown in the table below, this approach resulted in a slight performance difference.\n\n|                          | ACC   |\n|--------------------------|-------|\n| ConV varied threshold   | 80.1  |\n| F-ConV varied threshold | 90.1  |\n| ConV fixed threshold     | 79.12 |\n| F-ConV fixed threshold   | 89.43 |\n\n\n\n> Q3. Related to this, how does the cosine similarity distribution for natural vs. generated images compare across domains and datasets? Are there cases where similarities for generated images of one dataset are higher than those of natural images of another dataset? If this is the case, in practical, generic situations where natural images encompass all non-generated images, and synthetic images can come from any model with any training data, how should the decision threshold be decided?\n\nWe acknowledge that generated images can exhibit similarity scores surpassing those of natural images, which precludes achieving a 100% accuracy rate. In our experiments, to optimize overall accuracy, we establish the classification threshold at a value that maximizes the distinction between natural and generated images. However, in real-world applications, this approach may differ. For instance, to prioritize the detection of generated images, administrators may set a higher threshold, classifying only samples with similarity scores approaching 1 as natural images.\n\n\n> Q4. While it is intuitive to use the same transformations as those used in the feature extractor’s training, are there any empirical analysis to determine if all of them are truly necessary, or are specific ones that contribute more and would suffice (holding the number of transformations constant)?\n\nWe express our appreciation for the reviewer’s valuable suggestion. To further investigate the impact of data transformations, we conducted additional ablation studies on the transformation functions employed. The experimental results show that the three transformations all have an impact on the detection effect.\n\n|                         | AUROC | AP    |\n|-------------------------|-------|-------|\n| ConV                    | 87.13 | 85.15 |\n| ConV w/o HorizontalFlip | 86.55 | 84.19 |\n| ConV w/o ColorJitter    | 85.97 | 83.74 |\n| Conv w/o GaussianBlur   | 85.49 | 82.83 |"}, {"review_id": "yiJghe9V61", "reviewer": "Reviewer_xMhJ", "summary": "The core concept of **ConV** involves analyzing the data manifolds of natural images instead of depending on data from generated images, thereby avoiding the reliance of current methods on generated image datasets. This improves the generalizability of the detection methods, particularly when dealing with unknown generative models. The proposed approach leverages pre-trained self-supervised models (e.g., DINOv2) to extract features from images and assesses whether an image is synthesized by measuring the feature consistency between the original image and its transformed variants. Being training-free, it reduces computational costs and enhances flexibility in deployment. Also, the using of Normalizing Flows further enhances detection performance.", "questions": "1. Does this method remain effective when applied to larger and more recent models, such as Flux, that are trained on extensive datasets like LAION?\n2. Why does the performance of the training-free method on DiT significantly lag behind that of the baseline in Tab.1?", "limitations": "No limitations discussed in this paper.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. Generalization Capability: ConV is independent of specific generative models, enabling it to excel when confronted with unknown generative models. In particular, it has demonstrated excellent performance in experiments detecting unpublished models such as Sora.\n2. Computational Efficiency: The training-free nature of this method results in high efficiency during practical applications, making it ideal for environments with limited computational resources.\n\nWeaknesses:\n1. The writing in this paper requires significant improvement.  Some sentences are confusing and difficult to read, such as the first paragraph of Section 2.1. Also, there is missing information; for instance, in Figure 2, it is unclear which color represents real images and which represents fake images. There are also formatting issues, such as inconsistent spacing observed in line 130. Moreover, there are inconsistencies in notation usage. For example, in line 107, \"x_n\" is used to denote natural images, but throughout the rest of the paper, \"x_m\" appears to be used instead.\n2. Although ConV achieves strong results as indicated in Table 1, it seems that the primary contributing factor is the pre-trained model, such as DINOv2 (refer to line 269). This factor should not be disregarded and warrants further discussion. This is my major concern about this paper.\n3. Why is the first item, starting on line 81, considered the main contribution of this paper?", "was_revised": true, "final_justification": "Most of my concerns have been well addressed, and as a result, I have increased my score.", "rebuttal": "We are truly grateful for the reviewers' dedicated efforts. The valuable comments greatly improve the quality of our work. We provide the following answers to the reviewers' concerns.\n\n\n> Q1. The writing in this paper requires significant improvement. Some sentences are confusing and difficult to read, such as the first paragraph of Section 2.1. Also, there is missing information; for instance, in Figure 2, it is unclear which color represents real images and which represents fake images. There are also formatting issues, such as inconsistent spacing observed in line 130. Moreover, there are inconsistencies in notation usage. For example, in line 107, \"x_n\" is used to denote natural images, but throughout the rest of the paper, \"x_m\" appears to be used instead.\n\nWe express our gratitude for the reviewer’s kind suggestion. We have added the following clarification to our revision.\n- In Figure 2, red dots denote the feature representations of natural images, while purple dots represent those of generated images. \n- The terms $\\mathbf{x}\\_{\\mathcal{M}}$ and $\\mathbf{x}\\_{\\mathcal{n}}$ convey distinct meanings: $\\mathbf{x}\\_{\\mathcal{n}}$ corresponds to the feature representation of a natural image, whereas $\\mathbf{x}\\_{\\mathcal{M}}$ represents the projection of a generated image’s features onto the manifold of natural images.\n\n> Q2. Although ConV achieves strong results as indicated in Table 1, it seems that the primary contributing factor is the pre-trained model, such as DINOv2 (refer to line 269). This factor should not be disregarded and warrants further discussion. This is my major concern about this paper.\n\nThank you for your insightful comment. To further validate the effectiveness of our proposed method, we conducted additional experiments across a range of backbone models, including MoCo, SwAV, DINO, CLIP, and SigLIP.\n\nConV operates without any additional training and relies solely on a pre-trained feature extractor. Its performance is therefore contingent on the extractor’s ability to strike a delicate balance: accurately capturing the intrinsic structure of natural images while avoiding overgeneralization to generated content. As a result, ConV is inherently sensitive to the choice of feature extractor, as demonstrated in the results reported below.\n\n|                             | AUROC | AP    |\n|-----------------------------|-------|-------|\n| MoCo                      | 68.43 | 67.65 |\n| SwAV     |   74.71   |  73.48     |\n| DINO |    71.91   |  69.46     |\n| ConV DINOv2 ViT-L/14   | 87.13 | 85.15 |\n| ConV CLIP ViT-L/14     |  72.99  | 72.98      |\n| ConV DionV2-vit-b      |   78.58    | 76.39      |\n|SigLIP|84.19|81.93|\n\nNevertheless, this sensitivity can be substantially alleviated through fine-tuning the feature extractor, as further evidenced by the performance improvements shown in the accompanying table.\n\n\n|                        | AUROC | AP    |\n|------------------------|-------|-------|\n| ConV DINOv2 ViT-L/14   | 87.13 | 85.15 |\n| ConV CLIP ViT-L/14     |  72.99  | 72.98      |\n| ConV DionV2-vit-b      |   78.58    | 76.39      |\n| F-ConV DINOv2 ViT-L/14 | 93.77 | 93.38 |\n| F-ConV CLIP ViT-L/14   |   94.25  |  94.11   |\n| F-ConV DINOv2 ViT-B/14 |   89.17    |  88.54     |\n\nThanks again for your constructive comments. Accordingly, the above results have been added to our revision.\n\n> Q3. Why is the first item, starting on line 81, considered the main contribution of this paper?\n\nMost AI-generated image detection methods involve training a binary classifier for natural images and generated images. This approach implicitly assumes that generated images share certain shared features. However, as generative models continue to evolve, this assumption may be challenged. Instead, in this paper, we focus on how to distinguish between natural images and generated images by simply fitting the natural distribution, thereby avoiding any prior assumptions about generated images.\n\n\n> Q4. Does this method remain effective when applied to larger and more recent models, such as Flux, that are trained on extensive datasets like LAION? \n\nThank you for your constructive suggestion. We further assessed the performance of ConV on the Flux model by constructing a new evaluation dataset comprising 6,000 images generated by the FLUX.1 [dev] model, alongside natural images sampled from ImageNet. As shown in the table below, ConV demonstrates strong performance on this previously unseen generative model, further highlighting the generalizability of our approach.\n\n|        | AUROC | AP    |\n|--------|-------|-------|\n| ConV   | 87.38 | 89.19 |\n| F-ConV | 90.18 | 90.65   |\n\n> Q5. Why does the performance of the training-free method on DiT significantly lag behind that of the baseline in Tab.1?\n\nWe speculate that this phenomenon can be intuitively explained using the FID (Fréchet Inception Distance) score. The FID score is a commonly used evaluation metric for generative models, primarily assessing the quality of the generative model by comparing the distribution differences between generated images and natural images in the feature space. A lower FID score indicates that the distribution of the generated images is closer to that of the natural images. As shown in the table below, we have listed the FID scores of several generative models, along with the detection performance of ConV on these models. It is clearly evident that as the FID score of the generative model increases, the detection performance of ConV improves. This is because ConV leverages the differences in data distribution between natural images and generated images for detection. When the differences in data distribution between generated images and natural images are small, directly using ConV may not yield satisfactory results. In such cases, we can employ the proposed F-ConV, which utilizes manifold learning to push generated images out of the natural distribution, thereby increasing the distribution differences between the two.\n\n|          | AUROC | AP    | FID   |\n|----------|-------|-------|-------|\n| ADM      | 88.89 | 86.60 | 11.84 |\n| ADMG     | 82.46 | 79.83 | 5.58  |\n| LDM      | 78.94 | 75.88 | 4.29  |\n| DiT-XL-2 | 75.25 | 70.11 | 2.80  |"}, {"review_id": "BI95bhz09w", "reviewer": "Reviewer_QsoV", "summary": "This paper proposes ConV, a framework for detecting synthetic images by exploiting geometric differences between the data manifolds of natural and generated images. Specifically, the method measures feature similarity between an image and its augmented version using a self-supervised model pretrained on natural images (e.g., DINOv2). If the difference exceeds a certain threshold, the image is classified as synthetic. To further enhance detection performance, the authors proposed F-ConV that introduces a flow-based extension that uses normalizing flows to push synthetic images away from the natural manifold. Experiments on standard benchmarks and Sora-generated datasets demonstrate the effectiveness of both ConV and F-ConV.", "questions": "1. Regarding Figure 2: How are the embeddings generated; What do the “natural images” and “synthetic images” refer to in this visualization?\n2. Can the proposed method be extended to detect AI-edited images (e.g., real images with minor synthetic modifications)?\n3. *Page 4, Line 134:* The text states: “we denote $x_M(x_g)$ as $x_M$ for simplicity.” Should here be  $\\texttt{x}_\\mathcal{M}(\\texttt{x}_n)$ referring to the natural image instead?", "limitations": "Please refer to the **Weaknesses** section above for a discussion of key limitations.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths:** \n\n1. The paper is well written and clearly structured.\n2. Experimental results are thorough, with comparisons against a wide range of strong and up-to-date baselines.\n3. The proposed method is conceptually novel and computationally efficient, particularly in its training-free form, which performs competitively with existing training-based approaches for detecting synthetic images from certain generative models.\n\n**Weaknesses**\n\n1. **Gap Between Motivation and Implementation:** While the paper is motivated by geometric differences in data manifolds and an orthogonality principle between functions $f_1$ and $f_2$, the implementation primarily relies on the augmentation invariance learned during large-scale self-supervised training on natural images—an advantage not shared by unseen synthetic images. This central discriminative factor is not sufficiently discussed in the motivation (Sections 2.1–2.3). Moreover, the theoretical formulation assumes both $f_1$ and $f_2$ are differentiable, yet $f_2$ includes a random augmentation operator, which is not explicitly differentiable. These discrepancies suggest a deviation between the theoretical premise and the practical implementation.\n\n2. **Insufficient Validation of Flow-Based Extrusion (F-ConV):** The benefits of using normalizing flows to extrude generated images away from the natural manifold are not fully validated. For instance, adding a supervised classifier on top of DINOv2 embeddings could serve as a baseline to isolate and better understand the contribution of the flow-based component.\n3. **Thresholding Details:** The threshold that determines whether an image is synthetic is a critical component of the proposed method. While briefly mentioned in Appendix (Page 14, Line 514), more detail/discussion is needed regarding how this threshold is chosen and whether it generalizes.\n4. **Performance Variability Across Generative Models:** As shown in Tables 1 and 5, the proposed ConV/F-ConV do not consistently outperform all baselines. For images generated by models such as DiT, Stable Diffusion v1.4/1.5, and GLIDE, performance lags behind other methods by a notable margin. A deeper analysis of these failure cases could yield valuable insights into the limitations of the approach and its sensitivity to different generative model architectures or styles.", "was_revised": true, "final_justification": "While I still maintain my view that, based on the current implementation, augmentation invariance for natural images in SSL models could serve as an equally appropriate and perhaps more intuitive theoretical foundation (in the sense that one could develop a paper with a similar implementation/experiment but framed under this alternative motivation, and potentially making the theoretical justification more straightforward), most of my concerns regarding the proposed motivation have been addressed. I have accordingly adjusted my rating upward. I also appreciate the authors’ timely and thorough engagement throughout our discussion.", "rebuttal": "We are truly grateful for the reviewers' dedicated efforts. The valuable comments greatly improve the quality of our work. We provide the following answers to the reviewers' concerns.\n\n\n> Q1. Gap Between Motivation and Implementation, and differentiable issue.\n\nInresponse to your valuable comment, we have added the following details to our revision to highlight the derivation process of our method.\n\nOur method is based on the proposed orthogonality principle, i.e., Eq. 6. Subsequently, we introduce Eq. 8 inspired by previous works for realization. Namely, the gradient of a neural network w.r.t. the input is orthogonal to the tangent space. According to the well-know property of transformation, we can realize f2 using a composite function, where the utilized transformation models the transformation along local data manifold. Thus, we derive the orthogonal property in Eq. 11. \n\nMost transformations used in the literature can be differentiable by introducing the bilinear interpolation [1,2], usually implemented by the torch.nn.functional.grid_sample function.\n\n\n> Q2. Insufficient Validation of Flow-Based Extrusion (F-ConV)\n\nThank you for your kind suggestion. To provide a stronger comparison, we additionally trained a binary classifier on the DINOv2 embeddings using the same training set. As shown in the table below, the performance of the directly trained binary classifier falls short of that achieved by F-ConV, highlighting the advantage of our manifold-based approach.\n\n|                       | AUROC | AP    |\n|-----------------------|-------|-------|\n| Linear classification | 87.83 | 86.49 |\n| F-ConV                | 93.77 | 93.38 |\n\nThanks again for the constructive comment. Accordingly, we have added the above results to our revision.\n\n> Q3. Thresholding Details: The threshold that determines whether an image is synthetic is a critical component of the proposed method. While briefly mentioned in Appendix (Page 14, Line 514), more detail/discussion is needed regarding how this threshold is chosen and whether it generalizes.\n\nThanks for pointing out this potentially confusing description issue. We have added the following explanations to our revision.\nTo optimize overall accuracy, we can establish the classification threshold at a value that maximizes the distinction between natural and generated images. However, in real-world applications, this approach may differ. \n\nFor instance, to prioritize the detection of generated images, administrators may set a higher threshold, classifying only samples with similarity scores approaching 1 as natural images. This is consistent with the motivation of leveraging AUROC and AP as the main metric for evaluation.\n\nRegarding the threshold of accuracy, we used the training set from GenImage to select a threshold and applied that threshold to all test sets. As shown in the table below, this approach resulted in a slight performance difference.\n\n|                          | ACC   |\n|--------------------------|-------|\n| ConV varied threshold   | 80.1  |\n| F-ConV varied threshold | 90.1  |\n| ConV fixed threshold     | 79.12 |\n| F-ConV fixed threshold   | 89.43 |\n\n\n> Q4. Performance Variability Across Generative Models: As shown in Tables 1 and 5, the proposed ConV/F-ConV do not consistently outperform all baselines. For images generated by models such as DiT, Stable Diffusion v1.4/1.5, and GLIDE, performance lags behind other methods by a notable margin. A deeper analysis of these failure cases could yield valuable insights into the limitations of the approach and its sensitivity to different generative model architectures or styles.\n\nWe speculate that this phenomenon can be intuitively explained using the FID (Fréchet Inception Distance) score. The FID score is a commonly used evaluation metric for generative models, primarily assessing the quality of the generative model by comparing the distribution differences between generated images and natural images in the feature space. A lower FID score indicates that the distribution of the generated images is closer to that of the natural images. As shown in the table below, we have listed the FID scores of several generative models, along with the detection performance of ConV on these models. It is clearly evident that as the FID score of the generative model increases, the detection performance of ConV improves. This is because ConV leverages the differences in data distribution between natural images and generated images for detection. When the differences in data distribution between generated images and natural images are small, directly using ConV may not yield satisfactory results. In such cases, we can employ the proposed F-ConV, which utilizes manifold learning to push generated images out of the natural distribution, thereby increasing the distribution differences between the two.\n\n|          | AUROC | AP    | FID   |\n|----------|-------|-------|-------|\n| ADM      | 88.89 | 86.60 | 11.84 |\n| ADMG     | 82.46 | 79.83 | 5.58  |\n| LDM      | 78.94 | 75.88 | 4.29  |\n| DiT-XL-2 | 75.25 | 70.11 | 2.80  |\n\n\n> Q5. Regarding Figure 2: How are the embeddings generated; What do the “natural images” and “synthetic images” refer to in this visualization?\n\nTo visualize the feature distributions of natural and generated images, we use the DINOv2 model to extract their features/embeddings and apply t-SNE for dimensionality reduction. In the resulting visualization, red dots denote features of natural images, while purple dots represent those of generated images.\n\n> Q6. Can the proposed method be extended to detect AI-edited images (e.g., real images with minor synthetic modifications)?\n\n\nThanks for your inspiring question. We further evaluated the performance of ConV using tampered images from the SD_inpaint dataset. This dataset was constructed by first obscuring regions of natural images and subsequently restoring them using a DDPM-based inpainting model. As shown in the table below, ConV demonstrates strong detection performance on this form of partial image manipulation, highlighting its effectiveness beyond fully generated content.\n\n|      | AUROC | AP    |\n|------|-------|-------|\n| ConV | 83.32 | 84.43 |\n\n> Q7. Page 4, Line 134: The text states: “we denote $x_M(x_g)$ as $x_M$ for simplicity.” Should here be referring to the natural image  $x_M(x_n)$ instead?\n\nWe apologize for any confusion. The notation $\\mathbf{x}\\_{\\mathcal{M}}(\\mathbf{x}\\_g)$ denotes the projection of a generated image $\\mathbf{x}\\_g$ onto the natural image manifold $\\mathcal{M}$; that is, it represents the closest point to $\\mathbf{x}\\_g$ lying on $\\mathcal{M}$. In contrast, a natural image $\\mathbf{x}\\_n$ is already assumed to reside on the manifold, and thus its projection satisfies $\\mathbf{x}\\_{\\mathcal{M}}(\\mathbf{x}\\_n) = \\mathbf{x}\\_n$.\n\n\n***Reference***\n\n[1] Spatial Transformer Networks, Max Jaderberg, Karen Simonyan, Andrew Zisserman, Koray Kavukcuoglu, NIPS 2015\n\n[2] Deformable Convolutional Networks, Jifeng Dai, Haozhi Qi, Yuwen Xiong, Yi Li, Guodong Zhang, Han Hu, ICCV 2017"}]

Author rebuttal:

Meta-review: This paper was reviewed by four experts in the field. The paper received all positive reviews, i.e., 4 Borderline Accept, 5 Accept, 4 Borderline Accept, 4 Borderline Accept. 
After the discussion, most of the concerns raised by reviewers have been well addressed
Based on these positive reviews, the decision was made to recommend it for acceptance. We congratulate the authors on their acceptance!
Besides, authors should revise the paper taking into account the reviewers' comments.
Decision: Accept (spotlight)