Towards Generalizable Detector for Generated Image
Authors: Qianshu Cai
Chao Wu
Yonggang Zhang
Jun Yu
Xinmei Tian
Venue: NeurIPS 2025 poster ()
Keywords: Generated image detection
OOD detection
Learnable OOD detection
Primary area: deep_learning
TL;DR: We propose a novel perspective to understand AI-generated image detection through the lens of OOD detection and introduce  a generalizable training-free generated image detection method.

Abstract: The effective detection of generated images is crucial to mitigate potential risks associated with their misuse. Despite significant progress, a fundamental challenge remains: ensuring the generalizability of detectors. To address this, we propose a novel perspective on understanding and improving generated image detection, inspired by the human cognitive process: Humans identify an image as unnatural based on specific patterns because these patterns lie outside the space spanned by those of natural images. This is intrinsically related to out-of-distribution (OOD) detection, which identifies samples whose semantic patterns (i.e., labels) lie outside the semantic pattern space of in-distribution (ID) samples. 
  By treating patterns of generated images as OOD samples, we demonstrate that models trained merely over natural images bring guaranteed generalization ability under mild assumptions.
  This transforms the generalization challenge of generated image detection into the problem of fitting natural image patterns. 
  Based on this insight, we propose a generalizable detection method through the lens of ID energy. Theoretical results capture the generalization risk of the proposed method. Experimental results across multiple benchmarks demonstrate the effectiveness of our approach.

Towards Generalizable Detector for Generated Image
Qianshu Cai'
Chao 2a
Yonggang Zhang' Jun Yu Xinmei Tian'
MoE Key Laboratory of Brain-inspired Intelligent Perception and Cognition, University Science and Technology of China
3 School of Artificial Intelligence, Hebei Institute Communications "The Hong Kong University of Science and Technology The School of Intelligence Science and Engineering, Harbin Institute of Technology, Shenzhen
"Zhejiang University
Abstract
The effective detection of generated images is crucial to mitigate potential risks associated with their misuse. Despite significant progress, fundamental challenge remains: ensuring the generalizability of detectors. To address this, we propose a novel perspective on understanding and improving generated image detection, inspired by the human cognitive process: Humans identify an image unnatural based on specific patterns because these patterns lie outside the space spanned by those of natural images. This is intrinsically related to out-of-distribution (OOD) detection, which identifies samples whose semantic patterns (i.e., labels) lie outside the semantie pattern space of in-distribution (ID) samples. By treating patterns of generated images as OOD samples, we demonstrate that models trained merely over natural images bring guaranteed generalization ability under mild assumptions. This transforms the generalization challenge generated image detection into the problem of fitting natural image patterns. Based this insight, we propose generalizable detection method through the lens of ID energy. Theoretical results capture the generalization risk of the proposed method. Experimental results across multiple benchmarks demonstrate the effectiveness of our approach. Code is available htthh:tt///// htppa:////ithbb www.daooaaaaaeeeeao. joy
Introduction
In recent years, the development of generative Al has achieved significant breakthroughs. Specifically, diffusion-based generative technologies [22 10 [56] demonstrate revolutionary progress in the field of image synthesis. Advanced generative models, including Stable Diffusion (56). DALL-E 3 [50]. Midjourney (41), and FLUX (29), enable users to generate highly realistic images through simple text prompts. Furthermore, the advanced video generation model, Sora 47), can produce high-definition, highly realistic videos and even simulate some physical effects. However, this rapid technological progression
without its potential risks and challenges. The misuse of generated images for fraudulent purposes by malicious actors has sown seeds of doubt regarding the veracity of information in media sources. Therefore, it crucial to develop an effective generated image detector with strong generalization capabilities to address these emerging threats.
In the realm of generated image detection, the majority of existing approaches based on training binary classifiers [69
For instance, DIRE (69) employs diffusion reconstruction error as an indicator train binary classifier. AEROBLADE (55) introduces training-free approach that leverages the reconstruction error of an autoencoder to detect images generated by the Latent Diffusion Model (LDM) (56). Unfortunately. AEROBLADE is limited to detecting LDM-generated images and necessitates access to the autoencoder used for image generation. These methods,
68 64
*Corresponding author kkinmei@ustc.edu.co
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

however, confront a fundamental challenge: ensuring the generalizability of the constructed detector. In practical scenarios, generative models with unknown underlying architectures are frequently encountered, making the generalization challenge especially pronounced.
To address the generalization challenge, we revisit the process by which humans detect generated images. Humans who have only seen natural images can distinguish generated images with distinctive features. This could be attributed to the perception that the pattern of the generated image lies outside the space spanned by natural image patterns, In this regard, this out-of-space operation is also utilized in detecting dfittiiibittttinnnnnn (OOD) data. Namely, OOD detectors should distinguish samples with semantic patterns, i.c., labels, that lie outside the semantic pattern space of in in-distribution (ID) samples. The process by which humans recognize a generated image aligns with the principles of -utt----distibttioon (OOD) detection [73]. Humans have only seen natural images (ID) but can recognize generated images (OOD), and models have only seen II) samples but can detect OOD samples. This raises fundamental yet under-explored question: can a model that has only seen natural images be used to detect generated images?
In this work, we propose a novel perspective: examining generated image detection through the lens of OOD detection. In this context, the pattern of natural images is regarded as ID data, while the pattern of generated images is OOD data. Building on the learnability theory of OOD detection [2]. we study the generalizability of generated image detection, showing that models trained over natural images bring guaranteed generalization ability of generated image detection under mild assumptions. However, generated image detection relies on the disjoint space of specific patterns, while OOD detection focuses on the disjointed space of semantic labels for II) and OOD data. Namely, OOD detection can utilize classifiers trained on the label space of IID data, but generated image detection cannot use the classifiers trained for semantic labels.
To address this challenge, we draw inspiration from density-based and energy-based OOD detection. These methods highlight that the energy (density) of ID data is lower (higher) than that of OOD data. This is because models are trained to minimize (maximize) ID data's energy (density). Thus, we follow previous work and redefine the energy on ID data for generated image detection. Inspired by the seminal work in [6]), we reveal that self-supervised models such as DINOv2 [48] exhibit latent capabilities to discern pattern discrepancies between generated and natural images. Our theoretical results show that the learning objective of self-supervised models K4 essentially to minimize the differential energy score of II) data, i.e., natural images. Based on this insight, we propose a novel framework, termed differential energy-based detection (DEnD), to discern generated images leveraging pretrained self-supervised model, which demonstrates strong generalization capabilities.
Extensive experiments demonstrate that our method exhibits superior generalizability compared to training-based methods (69 68 64), and outperforms the state-of-the-art (SOTA) training-free methods. Our main contributions can be summarized as follows:
We propose novel view to understand and improve generated image detection by consider- ing the natural image pattern as ID data and the generated image pattern as OOD data. In this context, we prove that models trained over natural images bring guaranteed generalization ability of generated image detection under mild assumptions.
Drawing inspiration from energy-based OOD detection, we propose a novel framework termed differential energy-based detection (DEnD) to discern generated images, with theo- retical guarantees on its generalizability.
Comprehensive experimental results demonstrate that our DEnD framework not only sur- passes the SOTA training-free method but also outperforms most training- detectors. Moreover, our method exhibits remarkably strong generalization capabilities when faced with inaccessible generative models, e.g., Sora.
2 Related Work
Advanced Generative Models. Generative models have gained significant attention in recent years due their ability to produce high-quality synthetic images. Generative Adversarial Networks (GANs) 16 2 26 24 laid the groundwork for image generation. Following the advent of GANs,
A detailed explanation of this insight is provided in Appendix A

---

Natural Generated
Natural Generated
Self-superi models
Lower score
Natural
Density
Density
ligher
Generated
4.5
4.5
318
215
615
6.5
(a) Illustration of approach
Energy score
(c) Differential energy score
Figure 1: (a): We propose a score-based framework DEnD for generated image detection, where natural images exhibit lower differential energy scores and vice versa. (b): Directly detecting with
energy energy-based OOD detection method yields suboptimal performance. (c): Inspired by the training objective of self-supervised learning, we porpose to detect generated images with differential energy score, which demonstrates strong generalization capabilities (see Appendix B for more details).
diffusion- baseed generative technologies 22
44 10] demonstrate revolutionary progress in the field
of image synthesis. Recent advanced generative models such as Stable Diffusion [56], DALL-E 3 [50]. Midjourney [41] and FLUX [29] demonstrate capabilities in creating detailed images from textual descriptions, marking significant leap forward generative capabilities.
Generated Images Detection. Farly efforts on generated image detection primarily focused on color cues [39] and saturation cues [40]. However, with the emergence of ProGAN [[S] and the diffusion model [22]. these characteristics have become unreliable for detection purposes. Mcanwhile,
58 32 have also emerged. Mainstream training- graieing-based methods primarily focus on training a binary classifier network. CNNspot [68] for instance, manages to generalize binary classifier trained on ProGAN to other architectures through the use of specific data augmentation techniques. DIRE leverages the reconstruction error from diffusion models to train classifiers. Nevertheless, training-based methods are often constrained by limited generalizability and the high costs associated with training. To mitigate these challenges, training-free methods have emerged. AEROBLADE computes the reconstruction error using an autoencoder in latent diffusion models to detect generated images, but its effectiveness is limited to LDMs. ZED employs lossless encoder pre-trained on natural images and leverages the coding cost gap detect generated images. RIGID (20) exploits the differing robustness of real and Al-generated images to tiny noise perturbations within the representation space of vision foundation models. FSD
numerous frequency-based detection methods (28 13
43 extracts forensic microstructures from images and models the distribution of real images using a Gaussian mixture model. On the foundation of these previous works, we revisit the generated image detection task through the lens of OOD detection and implement the DEnD framework, which demonstrates superior generalization capabilities with theoretical guarantees.
Energy-based OOD Detection. Cet-of-DDisributiin (OOD) detection is critical area of research that focuses on identifying data samples that differ significantly from the training distribution. Conventional approaches rely on confidence scores derived from softmax outputs [21]. However, neural networks can yield arbitrarily high softmax confidence for inputs that are substantially distant from the training data 42). Energy-based OOD detection 33 the other hand, maps each input to a scalar value that lower for in-distribution (ID) data and higher for OOD data, thereby achieving superior performance. Theoretically, [12 has established the necessary conditions for the learnability of OOD detection and provided several sufficient conditions that characterize the learnability OOD detection in specific practical scenarios. This theoretical foundation underpins our approach.
Preliminary
In this section, inspired by the human cognitive process, formulate the generated image detection as an OOD detection task (see Sec. 3.1 and outline the primary objective of our paper (see Sec. 3.2)
3.1 Formulation
In this part, we elaborate on how to formulate generated image detection as an OOD detection task. Given feature space of natural and generated images X c. d and two pattern spaces Tn. {1) to
3

---

represent the pattern of natural images, Tg:= (2) to represent the pattern of generated images. We consider natural images as ID data and generated images as OOD data. Consequently, we have an ID joint distribution Dx,T., T., over X' x Tn. where X, E X and T, Tn are random variables. We also have an OOD joint distribution D,,T,, where Xg E X' and T. TT are random variables. In empirical observations, natural and generated images are mixed in arbitrary and unknown proportions:
Dxr == (1 ( + T Dx,T,
(1)
where the constant nout E [0, 1) is an unknown class-prior probability. We can only observe the marginal distributions:
(1-
+ Tuu DX,-
we define a subset of the function space as the hypothesis space H C ( (1,2]) represents the natural images, and represents the generated images. is called the hypothesis function. We explore the existence of hypothesis space H. such that for any joint distribution Dxt belonging to the density-basee based space X'r (see Appendix C.2 it satisfies generalizability (see Appendix C.1
3.2 Objective
Our design objective can be described as follows: Using model f trained over data S to design detector g. such that for any test data x drawn from the mixed marginal distribution Dx the detector can differentiate whether the input natural or generated. We define the differential energy score À (see Sec. 4.3) The detector classifies the data with lower scores as natural images and classifies the data with higher scores as generated images. The training data == (xl ,x.,, x") is drawn independent and identically distributed from the joint distribution of natural images Dx
4 Method
In this section, we first prove that the detector we have modeled in Sec. 3.1 exhibits generalizability under mild assumptions (see Sec. [.11). Sec. Based on the theory, we then consider an advanced approach in OOD detection: energy-based OOD detection (see Sec. [4.2). However, experiments reveal that directly applying energy-based OOD detection yields suboptimal performance. Motivated by this observation and inspired by the training objectives of self-supervised learning we present a generalizable training- free generated image detection framework, DEnD (see Sec. (43). We further provide theoretical guarantees (see Sec. (4.4) for the generalizability of our proposed method, establishing both its practical effectiveness and theoretical soundness.
4.1
Generalizability of Generated Detector
Despite the completion of our formulation, cannot ascertain under what circumstances the resulting detector can generalize. We consider a significant assumption in learning theory-the the Realizability Assumption (see Appendix C.3). This assumption implies that there exists at least one model in the hypothesis space H that can perfectly fit the training data, i.e., there are no classification errors. Under this assumption, we have significant lemma derived from the learnability of OOD detection [2]
Lemma 4.1 Given density- based space D if p(x) < +o0, the Realizability Assumption holds, then when H has finite Natarajan dimension [59], OOD detection learnable Du for H.
In our formulation, the generalizability of the detector and the learnability of OOD detection are equivalent. Therefore, have derived several conditions for the detector's generalizabilit:
((x) +oc, i.e., the feature space has finite measure.
An appropriate hypothesis space H is selected that satisfies the Realizability Assumption.
The hypothesis space H we selected has a finite Natarajan dimension. This indicates that the model's complexity is controlled and that it is capable of generalizing well to unseen data.
4.2 Easeg Detection
Since we have theoretically validated that the detector formulated as an OOD detection task is generalizable under mild assumptions, consider whether we can simply and directly apply OOD

---

detection methods to effectively detect generated images. We consider an advanced method in OOD detection: energy-based OOD detection 33
We consider discriminative neural classifier g(x) : RD D - RRK which maps input x E RRD to logits.
The energy-hased OOD detection defines the free energy function El(x; q) over E TR as:
E q) - -T log ex(x//
q. (x) indicates the i-th index of (xx). The temperature coefficient is treated hyperparameter.
Since the logit corresponding to the i-th label ds (x) can be expressed as q:(x) (f(x), w:), we can rewrite the free energy function as:
K
E(x) = -7 -7. log Σ ((()))
(4)
where f(x): RP Rd indicates the feature extracted from the input and w, R indicates the weight corresponding to the i-th label. We use (a, b) to denote the inner product of vectors a and theoretically prove that model trained with negative log-likelihood (NLL) loss will push down energy for in-distribution data points. In the actual detection process, inputs with higher energies are naturally considered as OOD inputs and vice versa.
33
Unfortunately, our experiments reveal that both natural and generated images exhibit indistinguishable energy distributions (see Figure (b), making it difficult for the detector to differentiate. This limitation arises because energy-based ood detection is typically derived from semantic label classifiers trained with NLL loss, whereas the discrepancy between natural and generated images manifests through divergences in high-level patterns rather than simplistic semantic label mismatches. To address this challenge, propose replacing semantic label classifiers with models that capture non-label global patterns and redefine an energy function aligned with the model's training objective.
4.3 Differential Energy-baas -based Detection
As demonstrated in 61 self-supervised models exhibit superior sensitivity to global characteristics compared to supervised models operating in label spaces. This property endows self-supervised models with latent capacities to discern pattern discrepancies between generated and natural images.
In supervipe learning [8] common approach is as follows: given feature extractor f()) within a batch of size N, for an anchor the positive sample is denoted as: x* = m(x), where m(x) indicates the random transformation such as Gaussian blur. The other N 1 samples are considered negative samples. Given the training sample x, the loss function can be expressed as:
el fe(x)))))(x())
llog IN folx(i)
where the notation Xo x denotes the positive sample resulting from the random transformation.
In the context of self-supervised learning, each negative sample x; is regarded distinct class within the discriminative model. Consequently, the features of the negative samples f(x,) are akin to the weights w, corresponding to their respective classes. By combining Equation and Equation 5 we redefine our energy function as follows:
N
E(x
((xx))
(6)
1=0
The sum is for one positive sample and N negative samples. In the self-supervised model [(x trained on IDD data, the training objective can be expressed as:
min Ex- Exxx fe).
3 Discussions on additional OOD detection approaches are provided Appendix
'Eneryy function discussed hereafter adhere the specific formulation presented this section.
5

---

In our framework, the random transformation function m(+) is treated as random variable, which is drawn from defined probability distribution M. This distribution encapsulates the likelihood of various transformations being applied to the data.
We sample k points from the random transformation distribution M. Each sampled point represents a transformation function (+) The training objective can be rewritten as:
min Ex Pin
Σ Em, (x: fo)
(8)
k
The notation Fm, denotes the energy resulting from the random transformation m,(*).
Therefore, for the energy of within the ID distribu- tion, we can deduce that for any e > 0:
89.8
88.0
[(x:)) - E(m, <.
(9)
38.2
89.2
88.0
80.0
As depicted in Figure in our experiments, we tested on ImageNet [9] with sampling from the random transformation distribution M at 1, 3, 5, 10, and 15 times. To strike a balance between accuracy and computational cost, opted for single sampling.
AUROC
14
Figure 2: Impact of sampling frequency from M on DEnD's ' performance.
Hence, we can deduce that for any > any ID data i.e., natural images, the following holds:
F[( f) F(m(x);; f] <.
(10)
Based on this approach, we obtained the differential energy score as follows:
X(x: f, m) Exx: f) E(m(x);;
(11)
As derived in Equation T0. the training objective of self-supervised models can be formulated as minimizing the differential energy scores for IDD data (natural images). Consequently, for drawn from the in-distribution (ID), which corresponds to natural images, >(x: f)) relatively small, as shown in Figure Ic Given the discrimination ability of the differential energy score, employ it in generated image detection:
g (x;Y m. = (Inatural) (generated)
if X S 7 if X 7
(12)
where y the threshold a and denotes the pre-trained self supervsed model. In practice, we employ the powerful self- sufervupee Vision Transformer (ViT) model DINOv2 (see Appendix [.2] for detailed selection of supf-supe models), which is pretrained on an exceedingly vast dataset of natural images. Images that exhibit higher differential energy scores are classified as generated, while those with lower differential energy scores are classified as natural.
4.4
Generalizability of DEnD
In this section, building upon Sec. we theoretically ground the Differential Energy-based Detection (DEnD) framework, demonstrating its generalizability for generated image detection.
In Sec. 4.1 we state that to ensure the detector's 's generalizability. the hypothesis space must satisfy the Realizability Assumption. Therefore, we first validate that proposed DEnD adheres this assumption. Our method designs H comprising a score-bases classifier (see Figure Tab:
h (x) = {1 X(x; f. m) $ 7- if X(x; f. m) >
(13)
'See Appendix D for complete derivation. FFor more detailed explanations regarding the threshold, please refer to Appendix

---

Table 1: The performance of various detectors ImageNet. The bolded text represents the best performance, and the underlined text represents the second-best performance.
Nathods
ADM
ADMG
LDM
DIT
BigGAN
GiaGAN AUROC
SyleGAN
RQ Tranfonnce
Mak GIT AUROC
Ancruee
AUBOC
AUROC
AUROC
AP
AUROC
ALROC
AUBOC
AP
Vruintn haaed Mathals
ENIvesa
62 25
B5.15
61:24
61:27
B3 16
54.31
6125
BS//1
$4.23
14:35
71.43
88.41
88.01
6131
01:1
6//04
16. 1X
DERE
50.29
55
50.20
37
03.58
52.70
NPR
855 68
50.56
88.34
79.79
91.98
66:96
96.15
51 25
50:73
$4.86
81.31
78.30
76.73
80.31
73.21
89:0
94.15
35 m3
50 84
DRCT
50.07
$5.24
$3.85
90
$5.88
W9.66
$5.89
26.12
59:11
85.39
92.41
91.84
00.36
90
AEROBLADE
35.11
54.26
63.57
50.58
62.
60:93
85.81
$2.21
44.3
45.66
41.39
48.14
47.35
45.54
67:15
67.99
43,05
68.75
57.87
57.85
RIGID
87.00
$5.20
81.22
77.00
14.00
60:51
70.23
07.17
$7.51
16.33
85:54
84.30
86.55
$5.41
93:65
83.20
8334
33.41
83:73
51
DEED (ouns)
01.03
$5.53
Table 2: The performance of various detectors on LSUN-BEDROOM The bolded text represents the best performance, and the underlined text represents the second-best performance.
Metheds
Models Diftusion GAN
Projected
StYRGAN
Unleashing Transforner
Avcrage
AUROC
AP
(1) (1)
Triniigg
CNNNggll
64:34
13.46
DRCT
Training
AEROBLADE
58:37
$7.34
53.85
$6:25
REGID
68.31
92.35
92.38
(ours)
85.14
62.34
93.96
96.75
98.8
The design of DEnD exploits the property that f results in relatively low M(x; f, m) for natural images and high values for generated images, driven by the training objective of the self-supervised models. This separation underpins the following theorem:
Theorem 4.2 If there exists a threshold 7 satisfying:
sup
Mxx; f. < < inf
X(x; f))
(14)
xEmopp
xxsuppXx,
the hypothesis space H' fulfills the Realizability Assumption, where supp means the support set.
The proof is detailed in Appendix C.4
The theorem demonstrates that, owing to the discriminative power of our method. the differential energy scores between natural and generated images are separa- ble and the Realizability Assumption holds. This provides critical assurance for the generalizability of our method. Building on the adherence of DEnD to the Realizability Assumption, we further establish the Generalizability Theorem for our proposed DEnD:
Theorem 4.3 Given the hypothesis space H! with finite Natarajan dimension, the DEnD framework is generalizable in D for H.
The proof is provided in Appendix differential energy score in its design, ensuring generalizability in theoretical settings. From practical perspective, as mentioned the section our method achieves excellent generalization capabilities, which align consistently with our theoretical analysis. Both aspects conclusively highlight the generalizability of our approach.
This theorem highlights DEnD's ability to leverage the
Experiments
In this section, we conduct series of experiments evaluate generated image detectors within practical scenarios that involve unknown generative models. The experimental results demonstrate that approach holds significant advantages. (Ablation Studies can be found in Appendix [T..
5.1 Setup
Datasets. We evaluate the performance of generated image detectors on two commonly used datasets: ImageNet [9] and LSUN-BEDROOM [74). For ImageNet, the generated images generated
7

---

Table 3: Performance (%) of various detectors Genlmage. All training-basse methods were trained on images generated by SD V1.4.
Models
Methods
Midjoumey
SD V1.3 ADM GLIDE
Wukong
VQDM
BigGAN Avg ACC(%)
Training- based Methods
ResNet-50
54,90
99.70
53,50
61,90
98.20
56.60
52.00
68.11
DeiT.S
55.60
99.80
49.80
58. 10
98.90
56.90
53.50
67.51
Swin-T
62.10
99.80
49.80
67.60
99.10
62.30
57.60
71.19
CNNsspo
52.80
95.90
50.10
39.80
78.60
53.40
46.80
58.63
Spec
99.20
49.70
49.80
$5.60
F3Net
50.10
99.90
49,90
50,00
99.90
49.90
49.90
64,22
Gea
54,20
99. 10
50.30
54.60
98.90
50.80
51.70
65.66
DIRE
50,90
55.00
50.10
UnivED
73.20
84.00
55,20
76.90
75.60
56.90
80.30
71.73
LaRE
66.40
87,
66.70
81.30
85.50
84.40
74.00
77.91
DRCT
94.63
99.82
61.78
65.92
99.91
74.88
58.81
79.39
GenDet
89.60
10
58.00
78.04
92.80
66.50
75.00
79.49
Training free Methods
AEROBLADE
80.30
86.89
67.20
81.57
83.74
51.10
52.53
71.00
RIGID
82.07
68.53
73,33
86.23
68.80
80.63
93.13
78.96
DEaD (ours)
89.44
71.88
94.46
99.07
76.27
96.61
97.84
89.37
Table 4: The performance of various detectors Sora.
Methods DRCT
Medels
CNNsspot
UnivFD
NPR
ABROBLADE
RIGHD
DEOD (ours)
AUROC
AUROC
AP
AUROC
AP
AUROC
AUROC
AP
AUROC
AP
AUROC
Stra
Open
50
68.67
50.25
51
81.79
80.11
55.79
62.37
75.56
90.79
Average
51,50
32,84
72.06
74.68
$1.09
51.05
92.15
81.20
56.46
60.19
78.67
78.77
89.07
91.99
with ADM 100,, ADM-G, LDM (56. DIT-XL2 [51]. BigGAN [2], GigaGAN (24). StyleGAN 126..
RQ-Transformer 33 and MaskGIT 5 For LSUN- BEUN-BEDROOM, generated images are generated with ADM, DDPM [22] iDDPM 44, Diffusion Projected GAN 70), Projected GAN (70), Style- GAN 26 and Unleashing Transformer []. To demonstrate the superiority of our method more realistic scenarios involving unknown generative models, evaluate the detectors two general and comprehensive benchmarks GenImage (79 and AIGCDeteccBennhmmat [77]. GenImage includes Stable Diffusion V1.4 (56). Stable Diffusion V1.5 (56). GLIDE (45), VQDM (17), Wukong (72), Big- GAN, ADM, and Midjourney 41) AIGCIDetecIBenchhaar 777 includes ProGAN 25). StyleGAN, BigGAN, StarGAN 17]. GauGAN 49), StyleGAN2 (27). WFIR (71), ADM, Glide, Midjourney,
Stable Diffusion V1.4, Stable Diffusion V1.5, VQDM, Wukong, DALL-E2 (54). To demonstrate
the generalizability of our method on unavailable generative models, we also evaluate detectors on The details and sources of the datasets can be found in Appendix G
Sora 47
Evaluation Metrics. We follow in the footsteps of pioneering researchers and adopt the Average Precision (AP) and the Area Under the Receiver Operating Characteristic Curve (AUROC) as our key evaluation metrics. In certain experiments, ensure comparability with established baselines, also include accuracy (ACC) as an additional evaluation metric.
Baselines. We utilize both maining-based and training-free methods as baselines. For training-
methods, we take DIRE [69]. CNNspot (68), UnivFD [46), DRCT (6) and NPR (64] as basclines. For some basclines,
get the results reported in their papers. including Frank [14], Durall (II),
Patchfor 4. F3Net 5 SelfBland [60], GANDetection [38] LGrad [65], 5esNet-50 [19] DeiT-
S [66). Swin-T 35 Spec [75]. F.r.FFeeDett (13), Fusing 23]. LNP [2], GenDet 778 LaRE [37] and
GramNet 36 For training- free methods, we take AEROBLADE 55 and RIGID
20 as baselines.
Experimental Details. In our experiments, we employ the powerful pre-trained self-supervised model DINOv2 [48. We adopted the DINOv2 ViT-L/14 model, recognized for optimal balance between speed and performance. We set the batch size N = 128 and temperature coefficient = 0.6,
which show the best performance (see Appendix [J]. Regarding the selection of m mxx,, we employ Gaussian noise with mean of and variance of 0.04 (see Appendix H)

---

Table 5: Performance (%) AIGCDDttctBBenchmak, All training- based methods trained on images generated by ProGAN.
Medels
POGGAN
StsteGANN
BUGAN
SUIGAN
GIIGAN
StYIGGAN2
WJJR
AUM
Glide
Midjouney
SDV1.4
SDV1.5
VQQUME
DALLBB
ACC/F)
CNNSSpt
100.00
50:17
71:17
94.00
81:42
96.91
01.65
693.30
$8.07
51:99
$3.57
99.53
56.46
51.04
$0145
70:78
PreDact
09. 56
78.02
$1.47
94.62
80.57
66.19
50.75
63.42
54.13
45.87
36.79
50.21
77.50
40.30
34.70
64.00
Pusing
100,00
15.20
77.40
07.00
72.00
K3.30
64.30
09.00
$7.20
12.20
51.00
51.40
55.10
51.70
52.80
68.33
LNP
59.67
91.75
77:25
99.92
75.39
94.64
70.35
84.21
10.52
06.15
85.55
85.67
74.46
$2.86
88.25
K1.M4
L(mnd
09.83
21.18
$5.62
99.21
78.06
85. 32
59:70
07-15
66.11
65-35
63.02
63.67
72.99
59.55
65:35 45
75 14.54
DIRE
00.39
83.03
70.12
95.67
67.79
73.31
58.05
75.78
71.75
58.01
49.74
49.53
53.68
$4.46
66.45
68. 18.68
UlikED
99.81
$4.93
95.08
95.75
99.47
74,96
$6.90
66.87
62.46
56.13
63.66
63.49
$5.37
70.93
50.75
78.43
Dite (ours)
98, 08
90.24
97.08
90
98.34
83.33
97.25
95.37
98.25
83:17
21.92
22.22
97.88
06.21
90.63
89.82
5.2 Main Results
2 compared to the training-based methods on LSUN-Bedroom and ImageNet, our method more generalizable and performs better against most generative models, showing significant improvement at the overall level and reflecting the superiority of our generalizable training- ffree method. Compared to the training-free methods AEROBLADE and RIGID, our method shows substantial improvement against most of generative models. While RIGID employs a noise-based approach based on empirical observation, we derive our approach from the training objectives of self-supervised models. This foundational perspective enabled us design more effective differential energy score, achieving better performance. Fur- thermore, as shown in Table and Table 5 when faced with more advanced and complex generative models, training-baser methods generally perform poorly against generative models that were not seen during the training process. In contrast, our method has excellent generalization capabilities and performs significantly better than existing training- based methods. However, due to limitations the pre-trained model's 's representational capabilities, when dealing with certain high-fidelity images, notably those from Stable Diffusion. We posit that this limitation could be alleviated by adopting models with enhanced representational capabilities.
Comparison with Existing Methods. As shown in Tables T and
method experiences performance degradation
Discussion on Generalization Capabilities. Our method demonstrates significant improvements in generalization performance. From a training perspective, conventional maining-based approaches often suffer from overfitting issues. As shown in Table S models trained on ProGAN exhibit satisfactory performance only when tested on other GAN-generated samples. In contrast, our training- free method inherently avoids overfitting risks. From theoretical perspective, given the variability of different generative architectures, the patterns of generated images can be highly diverse. This methods. In contrast, our method regards
complexity presents significant challenges for training- the patterns of all generated images as OOD data, maintaining strong generalization capabilities across various generative models. Furthermore, our method provides theoretical guarantees of generalizability, distinctive advantage absent in existing approaches.
Evaluation on Sora. Sora and other video generative models are often of unknown architectures. making the detection of these novel and unknown models more challenging. As demonstrated in Table 4 our experiments on Sora reveal that our approach achieves strong generalization capa- bilities, attaining competitive performance even when tested on generative models with unknown architectures a critical advantage absent in existing methods.
5.3 Robustness Evaluation
In practical scenarios, detectors are frequently confronted with degraded images. For example, lossy compression may induce artifacts, and noise is typically generated during transmission over communication channels. Following previous works (55), we evaluate the robustness of our detector against such prevalent conditions, encompassing assessments of JPEG compression, Gaussian noise, and Gaussian blur. These experiments are conducted on the ImageNet dataset.
As shown in Figure 3 DEnD demonstrates superior performance across various types of image degradation, reflecting strong robustness. In contrast, other training-based methods often show unsatisfactory performance. This advantage can be credited to the inherent generalization capabilities of our approach, which are underpinned by a solid theoretical foundation, allowing to consistently classify degraded ID data (natural images) as ID data (natural images).

---

90
AUROC
DEmD
60
JEnD
DtnQ
NP%
NPS
NPR
Ojho
Gtho
Otha
(b)
(C)
Figure 3: The performance of detectors when faced with degraded images. (a): JPEG with quality g. (b): Gaussain noise with standard deviation a. (c): Gaussain blur with standard deviation a.
Limitations
1) In this work, we formulate generated image detection as OOD detection task and propose a novel framework inspired by energy-based OOD detection. While our current approach prioritizes energy- based OOD detection, explicitly acknowledge the potential viability of alternative advanced OOD detection strategies. Future work will focus on exploring the applicability of other OOD detection strategies. 2) Extensive experiments demonstrate that our method achieves superior performance, which is attributed to our approach with theoretical guarantees. Nevertheless, limited by the training set scope, pre-trained models often fail to realize the full potential of our framework, especially when encountering a real data distribution shift (See Appendix [ In future work, we will attempt to fine-tune the model attain improved generalizability.
7 Conclusion
In this paper, drawing inspiration from the human cognitive ability to discern generated images, we propose novel perspective understanding and improving generated image detection: formulating as an OOD detection task. On this basis, we elucidate the feasibility of employing models trained entirely natural images for generated image detection. To operationalize this insight, introduce Differential Energy-based Detection (DEnD), a training-free and generalizable framework for generated image detection. Extensive experiments demonstrate that approach excels common benchmarks. Moreover, our method exhibits excellent generalization capabilities, effectively handling generative models with unknown architectures, such Sora. More broadly, our work only contributes theoretically but also provides generated image detection method with superior effectiveness and generalization capabilities, addressing the growing crisis of image forgery.
Acknowledgments and Disclosure of Funding
This work was supported by NSFC No. 62222117. YGZ was funded by Inno HK Generative AI R&D Center. CW was supported by Zhejiang Provincial Key Research and Development Project (2023C01043), Zhejiang Province Leading Geese Plan (2025C02025), and Academy Of Social Governance Zhejiang University. JY was supported by NSFC No. 62125201, U24B20174.
References
[1] Sam Bond-Taylor, Peter Hessey, Hiroshi Sasaki, Toby P. Breckon, and Chris G. Willcocks. Unlcashing transformers: Parallel token prediction with discrete absorbing diffusion for fast high-resolution image generation from vector-quantized codes. In Proceedings the European Conference Computer Vision. ECCV, 2022.
[2] Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale GAN training for high fidelity natural image synthesis. In International Conference Learning Representations, ICLR, 2019.
[3] Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In Proceedings of the IEEE/CVF international conference computer vision, pages 9650 1360,,966,,..6 2021.
10

---

[4] Lucy Chai, David Bau, Ser-Nam Lim, and Phillip Isola. What makes fake images detectable? understanding properties that generalize. In Proceedings of the European Conference Computer Vision, ECCV, 2020.
[5] Huiwen Chang, Han Zhang, Lu Jiang, Ce Liu, and William T. Freeman. Maskgit: Masked generative image transformer. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference, CVPR, 2022.
[6] Baoying Chen, Jishen Zeng, Jianquan Yang, and Rui Yang. Dret: Diffusion reconstruction contrastive training towards universal detection of diffusion generated images. In Forty-first International Conference Machine Learning.
[7] Yunjey Choi, Minje Choi, Munyoung Kim, Jung- Woo Ha, Sunghun Kim, and Jaegul Choo. Stargan: Unified generative adversarial networks for multi-domain image-to-image translation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 8789-8797, 2018.
[8] Davide Cozzolino, Giovanni Poggi, Matthias Nicßner, and Luisa Verdoliva. Zero-shot detection of al di-generated images. In European Conference Computer Vision, pages 54-72. Springer, 2024.
[9] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248 255. lece, 2009.
[10] Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat gans on image synthesis. In Advancex in Neural Information Processing Systems.NeurlPS, 2021.
[11] Ricard Durall, Margret Keuper, and Janis Keuper. Watch your up-convolution: CNN based generative deep neural networks are failing to reproduce spectral distributions. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference, CVPR, 2020.
[12] Zhen Fang, Yixuan Li, Jie Lu, Jiahua Dong, Bo Han, and Feng Liu. Is outtof-distriiuutinn detection learnable? Advances in Neural Information Processing Systems, 35:37199-37213, 2022.
[13] Joel Frank, Thorsten Eisenhofer, Lea Schönherr, Asja Fischer, Dorothca Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. In International conference machine learning, pages 3247-3258. PMLR, 2020.
[14] Joel Frank, Thorsten Fisenhofer, Lea Schönherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. In International Conference on Mackine Learning, ICML, 2020.
[15] Hongchang Gao, Jian Pei, and Heng Huang. Progan: Network embedding via proximity generative adversarial network. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 1308-1316, 2019.
[16] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley. Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets, Advances in neural information processing systems, 27, 2014.
[17] Shuyang Gu. Dong Chen, Jianmin Bao, Fang Wen, Bo Zhang, Dongdong Chen, Lu Yuan, and Baining Guo. Vector quantized diffusson model for text-to-image synthesis. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference, CVPR, 2022.
[18] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and puttern recognition, pages 9729-9736 38, 2020.
[19] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In The IEEE/ CVF Computer Vision and Pattern Recognition Conference, CVPR, 2016.
[20] Zhiyuan He, Pin-Yu Chen, and Tsung- Yi Ho. Rigid: training-free and agdel-agnostic framework for robust ai- di-generated image detection. arXiv preprint arXiv:2405.20111 2024.
[21] Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out -uttof-distribution examples in neural networks. arXiv preprint arXiv: 136, 2016.
[22] Jonathan Ho, Ajay Jain, and Pieter Abbeel, Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-688 2020.

---

[23] Yan Ju, Shan Jia. Lipeng Ke, Hongfei Xue, Koki Nagano, and Siwei Lyu. Fusing global and local features for generalized ai-synthesized image detection. In 2022 IEEE International Conference on Image Processing (ICIP), pages 3465-3469. IEEE, 2022.
[24] Minguk Kang, Jun-Yan Yan Zhu, Richard Zhang, Jaesik Park, Eli Shechtman, Sylvain Paris, and Taesung Park. Scaling up gans for text-to-image synthesis. In The IEEE/ CVF Computer Vision and Pattern Recognition Conference, CVPR, 2023.
[25] Tero Karras. Progressive growing of gans for improved quality, stability, and variation. arXiv preprint arXiv: 171.109900,, 2017.
[26] Tero Karras, Samuli Laine, and Timo Aila, A style-based generator architecture for generative adversarial networks. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference, CVPR, 2019.
[27] Tero Karras, Samuli Laine. Miia Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In Proceedings of the IEEE/CVF conference on computer vision and puttern recognition, pages 81 10-8119, 2020.
[28] Mahyar Khayatkhoei and Ahmed Elgammal. Spatial frequency bias in convolutional generative adversarial networks. In Proceedings of the AAAI Conference on Artificial Intelligence volume 36, pages 7152-7159, 2022.
[29] Black Forest Labs. Flux. httpa: httpe////gguuu...ccbccaeeee-e-e black forest- labs/fffttttaaa/llssaa 2024.
[30] Doyup Lec, Chihcon Kim, Sachoon Kim, Minsu Cho, and Wook-Shin Han. Autoregressive image generation using residual quantization. In The IEEE / CVF Computer Vision and Pottern Recognition Conference, CVPR, 2022.
[31] Tsung-Yo Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European conference on computer vision, pages 740-755. Springer, 2014.
[32] Bo Liu, Fan Yang. Xiuli Bi, Bin Xiao, Weisheng Li, and Xinbo Gao. Detecting generated images by real images. In European Conference Computer Vision, pages 95-110. Springer, 2022.
[33] Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy- out-of-distrihuttin detection. Advances neural information processing systems, 33:21464-2117777 2020.
[34] Xiao Liu, Fanjin Zhang, Zhenyu Hou, Li Mian, Zhaoyu Wang, Jing Zhang, and Jie Tang. Self-supervised lcarning: Generative or contrastive. IEEE transactions on knowledge and data engineering, 35(1):857-876 2021.
[35] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In JEEE/CVF International Conference on Computer Vision, ICCV, 2021.
[36] Zhengzhe Liu, Xiaojuan Qi. and Philip H. S. Torr Global texture enhancement for fake face detection in the wild. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference, CVPR, 2020.
[37] Yunpeng Luo, Junlong Du, Ke Yan, and Shouhong Ding. Lare" 2: Latent reconstruction error based method for diffusiin--eneraate image detection. In The IEEE/ CVF Computer Vision and Pattern Recognition Conference, CVPR, 2024.
[38] Sara Mandelli, Nicolè Bonettini, Paolo Bestagini, and Stefano Tubaro. Detecting gan-generated images by orthogonal training of multiple cnns. In International Conference on Image Processing, ICIP, 2022.
[39] Scott McCloskey and Michael Albright. Detecting gan-generated imagery using color cues. arXiv preprint 1nXiv:1812.00m 08247, 2018
[40] Scott McCloskey and Michael Albright. Detecting gan-generated imagery using saturation cues. In 2019 IEEE international conference on image processing (ICIP), pages 4584 4584-4588. IEEE, 2019.
[41] Midjoumey,
http://wwwwwmiiffoneeecomm cowpheeeycccmmmm//////e/////
2022.
[42] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 427-436, 2015.
12

---

[43] Tai D Nguyen, Aref Azizpour. and Matthew C Stamm. Forensic self-descriptions are all you need for zero-shot detection, open-set source attribution, and clustering of ai-generated images. In Proceedings of the Computer Vision and Puttern Recognition Conference, pages 3040-3050, 2025.
[44] Alexander Quinn Nichol and Prafulla Dhariwal, Improved denoising diffusion probabilistic models. In International Conference on Machine Learning, ICML., 2021.
[45] Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamcla Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. GLIDE: towards photorealistic image generation and editing with text-guided diffusion models. In International Conference on Machine Learning, ICML, 2022.
[46] Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detectors that generalize across generative models. In The IEEE/ CVF Computer Vision and Pattern Recognition Conference, CVPR, 2023.
[47] OpenAL. Sora: Creating video from text, 2024.
[48] Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy Vo, Mare Szaframiec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby, et al. Dinov2: Learning robust visual features without supervision. arXiv preprint arXiv:2304.07195 2023.
[49] Taesung Park, Ming-Yi Yu Liu, Ting-Chun Wang, and Jun-Yan Zhu. Semantic image synthesis with spatially- adaptive normalization. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2337-2346, 2019.
[50] William Peebles and Saining Xie. Scalable diffusion models with transformers. In Proceedings of the IEEE/CVF international conference computer vision, pages 4195-4205, 2023.
[51] William Peebles and Saining Xie. Scalable diffusion models with transformers. In IREF/CVF International Conference on Computer Vision, ICCV, 2023.
[52] Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by mining frequency- clues. In Proceedings of the European Conference on Computer Vision, ECCV, 2020.
[53] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 8748-8763. PmI.R, 2021.
[54] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06125. 1(2):3, 2022.
[55] Jonas Ricker. Denis Lukovnikov, and Asja Fischer. Aeroblade: Training- images using autoencoder reconstruction error. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pages 9130-9140 2024.
training-free free detection of latent diffusion
[56] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10695, 2022.
[57] Christoph Schuhmann, Richard Veneu, Romain Beaumont, Robert Kaczmarczyk, Clayton Mullis, Aarush Katta, Theo Coombes. Jenia Jitsev, and Aran Komatsuzaki. Laion-400m: Open dataset of clip- fil-filtered 400 million image-text pairs. arXiv preprint arXiv:2111.02114 2021.
[58] Katja Schwarz. Yiyi Liao, and Andreas Geiger. On the frequency bias of generative models. Advances in Neural Information Processing Systems, 14:188226-18166 2021.
[59] Shai Shalev-Shwartz and Shai Ben-David. Understanding machine learning: From theory to algorithms. Cambridge university press, 2014.
[60] Kaede Shiohara and Toshihiko Yamasaki. Detecting deepfakes with self-blended images. In The IEEE/ CVF Computer Vision and Pattern Recognition Conference, CVPR, 2022.
[61] George Stein, Jesse Cresswell, Rasa Hosseinzadeh, Yi Sui, Brendan Ross, Valentin Villecroze, Zhaoyan Liu, Anthony L Caterini, Eric Taylor, and Gabriel Loaiza-Ganem. Exposing flaws of generative model evaluation metrics and their unfair treatment of diffusion models. Advances in Neural Information Processing Systems, 36:3732- 3784, 2023.
13

---

[62] Yiyou Sun, Yifei Ming. Xiaojin Zhu, and Yixuan Li. Out-of-distribution detection with deep nearest neighbors. In International Conference Machine Learning, pages 20827-20840. PMLR. 2022.
[63] Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zhigniew Wojna. Rethinking the inception architecture for computer vision. In Proceedings the IEEE conference on computer vision and pattern recognition, pages 2818-2826. 2016.
[64] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethinking the up- sampling operations enn- basebased generative network for generalizable deepfake detection. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 28130-28 28139, 2024.
[65]
Chuangchuang Tan, Yao Zhao, Shikui Generalized artifacts representation for gan-generated images detection. In The IEEE/ / CVF Computer Vision and Pattern Recognition Conference, CVPR, 2023.
Wei, Guanghua Gu, and Yunchao Wei. Learning on gradients:
[66] Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In International Conference on Machine Learning, ICMI., 2021.
[67] Haoqi Wang, Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: matching. In Proceedings the IEEE/CVF conference on computer vision and pattern recognition, pages 4921 4930, 2022.
with virtual-loght
[68] Sheng- Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn-generated images are surprisingly easy to spot... for now. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8695-87000 8704, 2020.
[69] Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang. Hezhen Hu. Hong Chen, and Houqiang Li. Dire ceftusiiinngeerttedd image detection. Proceedings of the IFFF/CVF International Conference on Computer Vision, pages 2445522255, 2023.
[70] Zhendong Wang. Huangjic Zheng, Pengcheng He, Weizhu Chen, and Mingyuan Zhou, Diffusion-gal gan: Training gans with diffusion. In International Conference on Learning Representations, ICLR, 2023.
[71] Jevin West and Carl Bergstrom.
2022.
[72] Wukong, httpps://xiee http://hhh.ammppppprre///////bds
2022.
[73] Jingkang Yang. Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: survey. International Journal of Computer Vision, pages 1-28, 2024.
[74] Fisher Yu, Yinda Zhang. Shuran Song, Ari Seff, and Jianxiong Xiao. LSUN: construction of large-scale image dataset using deep learning with humans the loop. CoRR, 2015.
[75] Xu Zhang. Svebor Karaman, and Shih-Fu Chang. Detecting and simulating artifacts in GAN fake images. In International Workshop on Information Forensics and Security, WIFS, 2019.
[76] Zangwei Zheng, Xiangyu Peng. Tianji Yang, Chenhui Shen, Shenggui Li, Hongxin Liu, Yukun Zhou, Tianyi Li. and Yang You. Open-sora: Democratizing efficient video production for all, March 2024.
[77] Nan Zhong, Yiran Xu, Zhenxing Qian, and Xinpeng Zhang. Patcheraft: Exploring texture patch for efficient ai-generated image detection. arXiv preprint 1.XXx:2311112300 2023.
[78] Mingjian Zhu, Hanting Chen, Mouxiao Huang, Wei Li, Hailin Hu, Jie Hu, and Yunhe Wang. Gendet: Towards good generalizations for ai-generated image detection. arXiv preprint arXiv:2312.08880 2023.
[79] Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Hu, and Yunhe Wang. Genimage: million-scale henchmark for detecting ai-generated image. In Advances in Neural Information Processing Systems,NeurIPS, 2023. 2023.
14

---

A The Discriminative Capacity of Self-Supervised Models
Previous work [61 highlights that evaluation met- rics for generative models, such those based on Inception- V3 663 a model trained via supervised learning in label space-paceeeee prrimerly focus on category- related semantic information but exhibit insensitivity to features like texture and shape. This limitation also explains why common OOD detection methods trained in label space underperform. [61] emphasizes that self-supervised models, particularly DINOv2, trained on large-scale datasets capture representation spaces that better reflect global, label-agnostic seman- tic differences between generated and natural images. When designing generative model evaluation metrics, replacing Inception- V3 with self-supervised models like DINOv2 aligns with human evaluation. This observation underscores DINOv2's capability dis- cern pattern-level discrepancies between natural and generated images. However, directly applying self- supervised model's representation spaces for generated image detection is infeasible (see Figure 4 Compared evaluating generative models, generated image detection tasks demand higher dis- criminative power from models. Therefore, building upon the representation spaces learned by self-supervised models, we must further develop algorithmic approaches (our DEnD framework) to achieve effective generated image detection.
Natural Generated
Figure 4: t-SNE visualization features ex- tracted by DINOv2.
B Details of Figure 1
For Figure T6 and Figure Ic the natural images are from ImageNet and the generated images are generated by ADM. To facilitate visualization and comparison, normalize the x-axis values the range [0, 1]. For the y-axis, increased density within the distribution is positively correlated with higher incidence rate of frequency.
C Details of The Generalizability of Detectors
C.1
Generalizability of the Detector.
We Tall Tn U Ty. Given a loss function é Tall X Tall - R20 satisfying that ((t1, and only if t = t2 and any h E H. then the risk with respect to Dxr is:
Rh = Exxx))xDxx e(h t))
(15)
The a-risk
(h) (1 (1) aR (h), Va [0,
(16)
where (h) == Ex~Dx, {(((x). 1). and (h) == Ex~Dx, ((((x), 2). Following the definition
of learnability in OOD detection [12 we define the generalizability of the detector as follows:
Definition C.1 Given a domain space DxT and a hypothesis space C (h X Tau) we say the generated images detector is generalizable in Dxr for H. if there exists an algorithm A U (X x Ty" - H and monotonically decreusing sequence econa(11)), such that Econs (n'))(n') + 0, as - +00, and for any domain DXT DXT.
E
S Da' XuTh
RD(A(S)) inf RD RD(()) < (n').
(17)
NEH
And we say is strong generalizable when the following equation holds for Va [0,
E
D IT
(A(())))
inf R& S Econs(n').
(18)
NEH

---

In the real world, the distribution of natural images and the distribution of generated images are unknown given that g can be any value in (0.1). Therefore, strong generalizability more aligned with cal-world scenarios. In [2], Lemma C.2 indicates that generalizability and strong generalizability are equivalent in certain spaces. Our discussion primarily focuses on these spaces.
Lemma C.2 If for any domain Dxr Dxx and any E [0, 1) have:
xx = (1 Dx.TT. + aDx,T, E DXT.
(19)
then Equation 17 and Equation 18 arr equivalent in domain space D DXT.
C.2 Density-based Space.
Definition C.3 For any Dxt E ' there exists a density function f with 1/b s f s b in suppu and 0.5 Dx., + 0.5 * Dx2= = fdy, where is a measure defined over X.
C.3 Realizability Assumption
Assumption C.4 A domain space Dxr and hypothesis space H. satisfy the Realizability Assumption, if for each domain Dxr E DxT,, there exists at least one hypothesis function he" H such that RD(h")= = O.
C.4 Proof of Theorem 4.2
We prove that there exists ht E H such that RD(h*) = 0 for any Dxt E D there exists
7' E I such that:
sup X(x; < xEsupp(Dx.)
inf (xxupp(Dxx)
A(x; (x)
(20)
We define h² hy E Ht:
(x) [1 if X(x; f. S ST'
(21)
if X(x: f,m) 1/
The risk is:
RD(h²) = (1 - nut T Exx ((h((x), 1) + π Ex Dx E(1' (x)))x),)).
(22)
For x ~ Dx., 1(x; f. f.m) < ,/, , so (x) = 1, hence E (xx)-xxxx. E(h" (x), = 0. For x DX,:
X(x; f. m) > 7', so he- (x) 2, hence Ex~Dx, {(h- (x). ) 2) = Thus:
RD(h*) = (1 - = out 0.
(23)
We have completed this proof.
C.5 Proof of Theorem 4.3
For the model f sufficiently trained on data, according to Equation 10 we can obtain that for any 0 and for any ID data
X(x; f, m)
(24)
Therefore, we posit that under ideal conditions the sufficiently trained model satisfies:
sup
X(x; f. m) < <n'
inf
X(x; f.m..
(25)
xxsuppDx..
xx
From Theorem 4.2 we can deduce that the Realizability Assumption holds in the DEnD framework.
we can deduce that in the density-based space Duuh if j(X²) < +oo, and the DEnD hypothesis space H has finite Natarajan dimension, then the score-based detector within the DEnD framework is generalizable, which is Theorem 4.3
Hence, by Lemma 4.1

---

D Derivation from Equation to Equation 9
Since the feature extractor f(x) is normalized (I][(x) = 1), the energy function is bounded:
N Σ
f(x
(f()) S (N + +1ee = B.
(26)
1=0
That is to say:
E(x: f) S, E(m(x): S B.
(27)
Therefore:
f) (xm(x);; f] 2B.
(28)
The training objective in Equation 8 can be expressed as:
min Ex Σ Bm, (x: fo)].
(29)
After sufficient training, the model ensures that:
E Ex Pmn
k Σ
Fimy (x: s B 5,
(30)
where 8 0. Therefore:
Ex Pin k
[x(x f) (x); 2 6).
(31)
Since the optimization objective uniformly applies to all ~ PID, the above inequality holds for all natural images. Thus, for any c 0, choosing
c/2 ensures:
1 Σ [[x: f) f(ml Vx PID.
(32)
That is, Equation 9
Table 6: Comparison on detecting with different scores.
Scores E(x)
DEnD (ours)
Exm(x))
Datasets
AUROC
AP
AUROC
AP
AUROC AP
ImageNet
94.81
93.33
66.38
58.76
66.78
59.64
indicate that both E(x) and ((((()) can be minimized during training. the close proximity between the distributions of natural images and generated images leads our experiments (see Table 6) to demonstrate that simply reducing the energy ID data (natural images) to B 8 insufficient. During the training process, self-supervised models not only minimize the energy of ID data but also enforce the proximity between Exx) and E(m(x)). From this insight, we define the differential energy score, which imposes comprehensive requirements on both Exx) and Exm(x)), thereby serving a more discriminative score. Theoretically, the differential energy score on data can be minimized to 2B 28. Consequently, self-supervised model outputs lower differential energy scores for natural images while yielding higher scores for generated images. Experimental results demonstrate that the differential energy score achieves superior performance.
Although our results (Fquation 30 and Equation 31

---

Table 7: Comparison detecting with different OOD detection approaches.
OOD detection approaches
DEnD (ours)
Energy
ViM
KNN
Datasets
AUROC
AP
AUROC
AP AUROC
AP
AUROC
AP
ImageNet
94.81
93.33
46.36
55.12
60.38
66.11
52.12
55.95
E Discussions on Additional OOD Detection Approaches
validate and explain the limitations of directly applying the energy- OOD detection method. By grounding our approach in the training objective self-supervised learning, redefine the energy score and introduce on one specific OOD detection method, we do not dismiss the potential effectiveness of other approaches. We further evaluate other advanced OOD detection methods, such as KNN and tested on ImageNet. Experimental results in Table 7 demonstrate that directly applying OOD detection methods designed for label spaces is infeasible for generated image detection. This is because the distinction between natural and generated images lies in high-level patterns rather than simple semantic label differences. Therefore, we adopt category-agnostic self-supervised models and refine the energy score to achieve superior detection performance.
In Sec. 4.3
differential energy score. While Sec. 4 focuses
62 and
ViM [67] All methods are trained on
Details of The Threshold
In our experiments, directly computed the differential energy scores between natural and generated data separately. employing AUROC and AP as evaluation metrics. The assessment process does involve threshold selection. To clarify our methodology, Equation I2 explicitly adopts the discrimination threshold formulation.
For experiments requiring accuracy-based -based evaluation, it is quite difficult manually determine suitable threshold through visual observation for two large datasets. To find an optimal threshold, we randomly separated 2,000 natural and generated images validation (with overlap with the test set) and used an algorithm to identify the optimal threshold in the validation set. This threshold was then applied to calculate the accuracy on the
G Details of the Datasets
IMAGENET.
The source of the dataset be found at htttps://github. www.oooeroaiiilleeo labbs/ dgm eval We resize the image to 224 x 224 resolution as input. The real images are provided
by 9 The generated images include:
ADM, FID 11.84.
ADMG, FID 5.58.
BigGAN, FID 7.94.
DiT-XL-2, FID 2.80.
GigaGAN, FID=4.16.
LDM, FID=4.29.
StyleGAN-XI, FID=2.91.
RQ-Transformer, FID=9.71.
Mask-GIT, FID=5.63.
LSUN-BEDROOM. The source of the dataset can be found at htttps://githu: com/
layer6ai Daseaaillabb/eee labs/dgm-evall We resize the image to 224 x 224 resolution as input. The real images provided by 774. The generated images include:

---

ADM, FID-2.20.
DDPM, FID=5.18.
iDDPM, FID=4.54.
StyleGAN, FIID=2.65.
Projjccto-- GAN, FID=1.79.
Projected GAN, FID=2.23.
Unleashing Transformers, FID=3.58.
GenImage.
The source of the dataset can found at at/htpp:://gitmmm www. woom/Gennnageeeeei Daaaggtetatte//////
GenImage We resize the image to 224 x 224 resolution input. The images are provided by [79 The generated images include:
Midjourney.
SD V1.4.
SD V1.5.
ADM.
GLIDE.
Wukong.
VQDM.
BigGAN
Sora. To demonstrate the generalizability of our method on generative models with unknown architectures, collect Sora [47] generated videos and sample them obtain images. We collect the official demonstration videos and extract frames to obtain 5,000 images. Additionally, we utilize the open-source OpenSora [76] project to generate 100 videos, from which we also extract frames to get another 5,000 images, We use these images as generated images, and we randomly select 5,000 images from LAION [57 as natural images. We resize the images to 224 224 resolution. We employ these images to evaluate the generalizability of our method and compare them with baselines.
H Random Transformation Distribution
Table 8: DEnD's performances on datasets with different transformations.
Transformations
Gaussian filter
Gaussian noise
random rotate
salt and pepper noise
Datascts
AUROC
AUROC
AP
AUROC AP
AUROC
AP
ImageNet
92.82
91.0%
94.81
93.33
88.57
90.04
92.12
91.15
LSUN
94.54
93.11
96.05
95.03
64.21
60.06
92.10
90.07
Genimage
79.85
76.96
93.04
90.32
89.29
85.32
89.57
85.33
In our experiments, we evaluate diverse random transformation strategies m(x) used to generate positive samples during self-supervised model training, including adding Gaussian noise, apply- ing Gaussian filter, adding salt-and-peppa pepper noise, and rotating at random angles. Each of these transformations demonstrated robust performance, indicating their effectiveness in our study.
Our approach is highly adaptable, demonstrating commendable effectiveness with variety of com- mon random transformations. To complement our findings, we compared the average performance of some common image transformations across these datasets (see Table ( In our Gaussian filtering, we set the = 0.7. In the Gaussian noise, we set the mean 0, sld = 0.04. random rotation, we set the rotation angle to randomly select between (-10", 10%) In salt and pepper noise, we set the probability of adding salt noise and pepper noise both 14-4 Overall, adding Gaussian noise shows superior average performance. Consequently, employed Gaussian noise in our experiments.
5

---

Ablation Studies
Temperature Coefficient and Batch Size Selection
Table 9: DEnD's performance across varying temperature coefficients.
Temperature coefficient
= 0.4
f = 0.6
1.0
== 5.0
Datasets
AUROC
AP
AUROC AP AUROC AP AUROC AP
ImageNet
93.33
92.10
94.81
93.33
94.41
92.77
94.52
92.80
Regarding the temperature coefficient, our experiments (see Table demonstrate that it has minimal impact on the results. Specifically, different values within a reasonable range do not lead significant performance variations.
Table 10: DEnD's performance across varying batch sizes.
Batch sizes
N 16
N 128
N
256
Datasets
AUROC
AP AUROC
AUROC
AP AUROC
AP
ImageNet
89.53
86.22
93.30
92.81
94.81
93.33
94.11
92.49
As for batch size selection, experiment (see Table T0 reveals that larger values of N gener- ally improve effectiveness but also increase computational complexity. To balance accuracy and computational efficiency, ultimately adopted N=128 in our experiments.
I.2 The Selection of Self-supervised Models
Table 11: Comparison on detecting with different self sulervuee models.
Self-supervised models
DINO
CLIP
DINOv2
Datascts
AUROC
AUROC AP AUROC
AP
ImageNet
69.21
66.87
75.42
80.21
94.81
93.33
We also experimented with self supervisdd models, such as DINO 3 and CLIP [53] The results (see Table TTp demonstrate that other self-supervised models significantly underperform compared to DINOv2. Our method relies not only on the discriminative power of our differential energy score but also on representational capability of the adopted self-supervised model. Unlike DINO and CLIP, DINOv2 better captures global pattern-leve differences. These results align with [61. which states that DINOv2 usually focuses on the image structure as whole while still identifying objects of importance capability lacking in other self-supervised models. Consequently, [61] employs DINOv2's s representational space for generated image evaluation. Similarly, to better characterize pattern-level discrepancies between natural and generated images, DEnD framework adopts pre-trained DINOv2 model.
Further Discussion
Our method operates on the premise that the self-supervised model is pre-trained on an extensive and
diverse corpus of real images, thus ensuring lower differential energy scores for all natural images (ID
data). In practice, we employ DINOv2 ViT-L/14, pre-trained on the 14D- [48 dataset, which
is designed to cover as many natural image domains as possible. Although extensive experiments confirm our method's outstanding performance, and its theoretical foundation- reggadddng the patterns of all generated images as OOD Buta-enables generalization to unseen architectures, observe

---

Table 12: The performance of detectors under real data distribution shift. We investigate the impact of different real data sources, keeping the generated images sources consistent with Table [
Methods
RIGID
DEnD (ours)
Real Data
AUROC
AP
AUROC
AP
ImageNet
83.73
81.69
94.81
93.33
COCO
67.58
65.07
89.84
88.61
key limitation. As shown in Table 12 when we evaluated our method using COCO 31 as the source of natural images-a dataset exhibiting potential distribution shift from the training set of DINOv2-we observed a noticeable performance degradation. This observation is consistent with our theoretical framework, as the self-supervised model is optimized minimize the differential energy score only for real data from distributions encountered during training. We also observed that RIGID, another training-free free method that also leverages DINOv2, suffers an even more significant performance drop. This underscores the limitations stemming from the scope of DINOv2's s training data. As part of our future work, we plan to fine-tune our model on larger and more diverse real-world datasets to further enhance detection performance.
K
Compute Resources
As training-free method, our approach exhibits minimal computational overhead, which stands one of the key advantages of this work. All experiments were conducted on single NVIDIA GeForce RTX 4090 GPU with 24 GB memory. With a batch size of 128, the inference speed is approximately 0.5 seconds per batch.
L Broader Impacts
This article proposes novel approach for detecting generated images, offering an effective solution to identify and mitigate the proliferation of synthetic media. Our work contributes to reducing the spread of misinformation through synthetic content, with significant potential societal benefits. We recognize that generated images give rise to ethical concerns, particularly regarding privacy protection and consent issues. The proposed method addresses these challenges by establishing reliable detection framework. This research not only advances the field of generated image detection, but also represents critical step toward preserving digital media integrity in the AI era.

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We propose novel perspective understand Al-generated image detection through the lens of OOD detection and introduce a generalizable training-free generated image detection method.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
The limitations are discussed in Sec. 6
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-specfiiatiinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
8

---

Answer: [Yes]
Justification: The proofs of our theories can be found in the supplemental material. The lemmas referenced properly.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proof' in the paper should be numbered and cross referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Our experimental settings are provided in the paper. More experimental details can be found in the supplemental material.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [No]
Justification:
The code will provided as soon as possible when the paper is accepted.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.com cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" an acceptable answer. Papers cannot be rejected simply for including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ praips.cc/ubblicgguudee CoodeSumeeieeeeee ssi iessonPolll mollicyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Most details are provided in Sec. Sec. 5.1 The rest are provided in the supplemental material.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification:
Our approach follows previous settings and does not require reporting error
bars.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
10

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative rates).
show in tables or
error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The compute resources are provided in Appendix K
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: The research conducted in the paper conforms with the NeurIPS Code of Ethics in every respect.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The broader impacts are provided in Appendix
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: In our paper, have carefully acknowledged the creators original owners of all assets used.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
12

---

If assets are released, the license, copyright information, and terms of use in the thcode. has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
batasets.papersstt
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors encouraged to reach out the asset's s creators.
13. New assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The code and other assets will be released with documentation when the paper is accepted.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
13

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification:
The LLM is only for editing (e.g., grammar, spelling, word choice).
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: /ttpar:///eupp.... /0tps///ecccoooeeeeee//2/2////// for what should or should be described.
14


Reviews:
[{"review_id": "RUwEzXtJOn", "reviewer": "Reviewer_scx8", "summary": "This study presents a generalizable detector, Differential Energy-based Detection (DEnD), for detecting AI-generated images by modeling them as out-of-distribution (OOD) samples relative to natural images, inspired by human cognitive patterns. The authors address the generalization issue common in training-based detectors, which may (often) fail on unseen generative models. They argue that while traditional OOD detection leverages classifiers trained on semantic labels, generated image detection cannot rely on such classifiers due to the absence of consistent semantic labels in synthetic data. Instead, they propose using energy-based detection, grounded in the observation that in-distribution (ID) data typically exhibits lower energy scores than OOD data. To implement this idea, the method incorporates self-supervised learning using a pre-trained model (DINOv2) to capture differences between natural and generated image distributions. The model is optimized to minimize the differential energy score for ID data, detecting deviations in generated samples. The paper offers a theoretical foundation supporting the generalizability of the proposed approach and validates it through experiments. The evaluation spans datasets such as ImageNet and LSUN-BEDROOM, as well as generated image benchmarks including GenImage and AIGCDetectBenchmark, and a video dataset produced by Sora. The proposed DEnD method, evaluated using Average Precision (AP) and Area Under the Curve (AUC), outperforming both training-based and training-free baselines in different datasets.", "questions": "While the work has clear motivation, theoretical validation, a new proposal, and thorough experimental evaluation compared to relevant prior studies, the following comments are suggested to be addressed or at least acknowledged by the authors:\n\na.\tIn line 214, the statement that “self-supervised models... push down the differential energy” would benefit from clarification. It is recommended to either provide a supporting citation or an explanation of the basis for this claim.\nb.\tThe work appears highly relevant to Liu et al., “Detecting Generated Images by Real Images.” It would be desirable to explicitly compare the proposed method to this work, both in terms of conceptual differences and if possible, through experimental results.\nc.\tAlthough not strictly mandatory, it would be informative to include comparative performance on the UnivFD dataset (Ojha et al., “Towards Universal Fake Image Detectors That Generalize Across Generative Models”), which has become one of the standard benchmarks in the field.\nd.\tWhile the authors mention that they will release the code upon acceptance, in the rapidly evolving literature landscape, it is preferable to include code, trained weights, and sufficient documentation at the time of submission or during the rebuttal phase.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "a.\tQuality: The submission is technically sound, providing a clear problem statement, theoretical proofs, and experimental evaluations on relevant metrics. The claims are well-supported by both theoretical analysis and experimental results. The methods used are appropriate, and the work is presented as a complete and cohesive study. However, the potential for improvement lies in the detection of images generated by certain models (e.g., SD V1.5 and Wukong), where performance drops were observed. The experiments could be further expanded to include other publicly available datasets, such as the UnivFD dataset (Ojha et al., “Towards Universal Fake Image Detectors That Generalize Across Generative Models”). The authors are transparent in evaluating both the strengths and limitations of their work, and it would be a desirable (though not mandatory) enhancement to explicitly include the observed performance drop on images generated by a few generative models as a stated weakness in the paper.\n\nb.\tClarity: \nThe submission is clearly written and understandable. However, the authors are recommended to refine the following points:\n1. At line 139, remove the full stop after “assumptions”.\n2. In Table 4, there is a typo: “AEROBLADA”; this should be corrected to “AEROBLADE”.\n3. While the paper emphasizes that the model is inspired by human cognitive processes (as mentioned in line 5 and revisited in line 37), this concept is not mentioned again during the model development or in the conclusion. It is desirable to reiterate this point, at least in the conclusion, to help readers stay connected to the central motivation.\n4. At line 161, the use of the word “demonstrated” may be reconsidered. Since the corresponding lemmas are theoretically sound but do not empirically guarantee the claims, it might be more appropriate to state that the generalizability is “hypothetically” or “theoretically” validated.\n5. Regarding the generated image datasets used in Tables 1 and 2, although the GitHub source is provided in the supplementary material (Appendix G), it is recommended to include a formal citation within the main text. For instance, Stein et al., “Exposing flaws of generative model evaluation metrics and their unfair treatment of diffusion models”, could be cited if appropriate.\n6. Although the results section includes qualitative descriptions indicating better performance of the proposed method, it would be helpful to mention specific performance values in the main text where the model clearly outperforms or underperforms compared to baselines.\n\nc.\tSignificance: \nYes, the results are impactful for the community. While the GitHub code has not yet been released, if it is made available, it has the potential to be used by researchers. The work addresses the relevant task of detecting AI-generated images and demonstrates moderately improved performance compared to previous methods. While it does not introduce a new dataset, it does offer improved detection performance and contributes meaningfully to the field.\n\nd.\tOriginality:\nThe work presents a new method for generated image detection by comparing it to several relevant approaches from the forensic detection literature, based on the idea that only real images are used during training. The integration of self-supervised learning via DINOv2 is well-articulated. However, the paper appears to not include a comparison with a relevant method by Liu et al., “Detecting Generated Images by Real Images,” which may offer a meaningful point of reference.", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate the time and effort you have dedicated to reviewing our paper, as well as your constructive comments. In response to your feedback, we have provided detailed responses below, which have been incorporated into our revised version. We hope our responses address your concerns and contribute to enhancing our work.\n\n**W.1 It would be a desirable (though not mandatory) enhancement to explicitly include the observed performance drop on images generated by a few generative models as a stated weakness in the paper.**\n\nA.1 Thanks for your kind suggestion. We agree with your point that maintaining transparency about the limitations of our work is very important. Thus, we have added the following explanations and discussions in the revised paper. \n\nInspired by the human cognitive process of distinguishing real images from generated ones, we propose using a model pretrained entirely on real images for the task of generated image detection, leveraging the representational capabilities of the self-supervised vision model DINOv2 pretrained on a large corpus of real images. Although we have theoretically proven the generalizability of this approach and demonstrated strong performance across numerous datasets, in practice, due to limitations in the model’s representational capabilities, our method inevitably experiences some performance degradation when dealing with high-fidelity images. For example, our method achieves an accuracy (ACC) of only 71.88% on Stable Diffusion, significantly below the average. When facing highly realistic video models like Sora, although our method outperforms other baselines, its performance is still lower compared to its results on generative models with lower fidelity, such as GANs. \n\n**W.2 It would be informative to include comparative performance on the UnivFD dataset, which has become one of the standard benchmarks in the field.**\n\nA.2 Thank you for your constructive suggestion! We have added the following experiments and discussions to our revised version.\n\nFollowing previous standard benchmarking settings in the literature [1,2], we also compare our method with baseline methods over the UnivFD dataset [1]. The experimental results demonstrate that our method exhibits remarkable generalization capability, delivering robust performance across multiple benchmarks.\n\n||UnivFD[1]|NPR[2]|DEnD(ours)|\n|-|-|-|-|\n|ACC|86.9|95.2|92.1|\n|AP|94.5|97.4|98.5|\n\n**W.3 Clarity issues.**\n\nA.3 We sincerely appreciate your meticulous review, patiently pointing out clarity issues, and providing kind suggestions. Accordingly, we have fixed the mentioned clarity issues in the revised version. Namely, we have\n1. removed the full stop after \"assumptions\".\n2. fixed the typo, i.e., \"AEROBLADA\" to \"AEROBLADE\".\n3. highlighted the motivation in the sections of method and conclusion reiterate this point that our method is inspired by human cognitive processes.\n4. replaced the word \"demonstrate\" with a more rigorous one, i.e., \"theoretically validated\". \n5. included formal citations of [3] in the main text, especially the mentioned Tables 1 and 2. For instance, we have formally mentioned in the method section that Stein et al. pointed out that self-supervised models exhibit superior sensitivity to global characteristics compared to supervised models operating in label spaces. This inspired us to apply self-supervised models to the task of generated image detection.\n6. highlighted specific performance improvements. For instance, \"Compared to the baseline DRCT, our results on the GenImage dataset show a significant improvement of 11.05%, i.e., from 79.39% to 89.37%\".\n\nThank you again for your time and kind suggestions.\n\n**W.4 While the authors mention that they will release the code upon acceptance, in the rapidly evolving literature landscape, it is preferable to include code, trained weights, and sufficient documentation at the time of submission or during the rebuttal phase**\n\nA.4 We will release the code on GitHub with an anonymous link during the discussion phase.\n\n**Q.1 In line 214, the statement that \"self-supervised models... push down the differential energy\" would benefit from clarification. It is recommended to either provide a supporting citation or an explanation of the basis for this claim.**\n\nA.1 Thanks for pointing out this potentially confusing issue. We have added the following explanations in the revision.\n\nAs derived in Eq. 10, the training objective of self-supervised models can be formulated as minimizing the differential energy scores for ID data (real images). Consequently, real images exhibit significantly lower differential energy scores than generated images.\n\n**Q.2 It would be desirable to explicitly compare the proposed method to a previous one [4], both in terms of conceptual differences and if possible, through experimental results.**\n\nA.2 Thanks for your constructive suggestion! We agree that the difference between ours and the outstanding work [4] should be clarified. Thus, we have added the following discussions (in sections of related work and experiment) and results in our revision.\n\nA recent outstanding work also highlights the critical importance of real images in generated image detection [4]. We highlight that the difference between our work and [4] is twofold: 1) The detection process in [4] is modeled as a one-class classification problem, utilizing noise features and frequency domain analysis for detection, whereas our approach models the generated image detection task as an out-of-distribution (OOD) detection task and designs a differential energy score for detection based on the learning objectives of self-supervised models and 2) The actual training process in [4] requires a small number of real images and no generated images, while our method is zero-shot, requiring only a pre-trained model for detection. Moreover, to highlight the difference, we compared our method with [4] on GENImage[5]. The results show that our method can outperform the one-class classification approach.\n\n||Detect real[4]|DEnD(ours)|\n|-|-|-|\n|ACC|72.46|89.37|\n\n\n**Q.3 Although not strictly mandatory, it would be informative to include comparative performance on the UnivFD dataset (Ojha et al., “Towards Universal Fake Image Detectors That Generalize Across Generative Models”), which has become one of the standard benchmarks in the field.**\n\nA.3 Please refer to our response to Weakness 2.\n\n**Q.4 it is preferable to include code, trained weights, and sufficient documentation at the time of submission or during the rebuttal phase.**\n\nA.4 We will release the code with an anonymous link.\n\n[1] Ojha et al., Towards Universal Fake Image Detectors That Generalize Across Generative Models.\n\n[2] Tan et al., Rethinking the Up-Sampling Operations in CNN-based Generative Network for \nGeneralizable Deepfake Detection.\n\n[3] Stein et al., Exposing flaws of generative model evaluation metrics and their unfair treatment of diffusion models\n\n[4] Liu et al., Detecting Generated Images by Real Images.\n\n[5] Zhu et al., A Million-Scale Benchmark for Detecting AI-Generated Image."}, {"review_id": "FQ42dfFg10", "reviewer": "Reviewer_6ymL", "summary": "This paper proposes a novel framework for detecting AI-generated images by applying a tailored energy-based out-of-distribution (OOD) detection method to features extracted from self-supervised vision models such as DINOv2 and CLIP. The authors provide theoretical motivation for using energy-based formulations and evaluate their method across various datasets. The supplementary material contains additional experimental details and theoretical analysis.", "questions": "See above", "limitations": "See above", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n1.\tNovelty: This is the first work to apply an energy-based OOD method specifically to the task of detecting generated images. The use of energy-based detection methods for generated image detection provides a fresh and promising direction.\n\n2.\tTheoretical Rigor: The authors provide clear theoretical grounding for their method, offering insight into why energy-based scores should help distinguish real from generated content.\n\n3.\tComprehensive Supplementary Material: The appendix includes relevant additional experiments, ablations, and theoretical elaboration that enhance reproducibility and depth.\n\nMajor Weaknesses:\n\n1.\tMissing many recent rlevant works and experimental comparisons: \n\na.\tRigid - Zhiyuan He et al. Rigid: A training-free and model-agnostic framework for robust ai-generated image detection. arXiv preprint arXiv:2405.20112, 2024.  This paper uses DINOv2 and additive Gaussian noise to separate real and generated images and is conceptually close to the proposed work. Despite being unpublished, its relevance makes it appropriate for inclusion in the related work section. A comparison between the simple noise-based approach in Rigid and the energy-based formulation here would strengthen the claim that energy-based scores add meaningful value. \n\nb.\tManifold induce bias detection – J. Brokman et al, “Manifold induced biases for zero-shot and few-shot detection of generated images”, ICLR 2025.  - This is a recent and peer-reviewed zero-shot detection method that predates the submission deadline by approximately four months and offers publicly available code. It is not cited or compared against, which is a critical omission for a paper in this domain.\n\nc.\tZED [7] – Although ZED is briefly mentioned in the related work section, there is no experimental comparison. Given its relevance as a recent zero-shot detection method, a direct comparison is essential to establish the strength and limitations of the proposed approach.\n\nOverall, the absence of experimental comparisons to key recent methods — including ZED, Rigid, and the manifold based detector — makes it difficult to assess the competitiveness and generalizability of this work within the current state of the field. Notably, all three of these methods have been shown to strongly outperform AEROBLADE, as is also demonstrated in this work.\n\n2.\tIncorrect experimental framing: The current experiments do not evaluate real vs. generated image detection directly. Instead, they perform OOD detection between generated images and a single real dataset (e.g., ImageNet or LSUN). These datasets are commonly used in OOD detection tasks and primarily reflect domain shifts rather than generation artifacts, making them unsuitable for evaluating real-versus-generated image detection directly. Proper evaluation should treat all real images as in-distribution and generated images as out-of-distribution, regardless of which real dataset is used for calibration. Additional experiments are needed to confirm that the method generalizes across real domains — specifically, by calibrating the in-distribution (ID) on one real dataset and testing on a different real dataset treated as ID.\n\nMinor Weaknesses:\n\n1.\tClarity on novelty vs. prior work in method section: The method section should more explicitly differentiate between components borrowed from prior OOD methods and those introduced in this work. It would also be valuable to evaluate the proposed approach on standard OOD benchmarks, even if the expected performance is low — this would reinforce the claim that it is purpose-built for detecting generated images rather than general OOD tasks.\n\n2.\tPipeline presentation: While the theoretical formulation is clearly written, the practical method pipeline is difficult to follow. The paper would benefit from a visual figure or algorithm block summarizing the full detection process, from feature extraction to energy computation and thresholding. In particular, the role of the batch size N is unclear — since the detection method should operate independently on each image, the use of a batch suggests possible dependence on other samples. If the method compares the input image to negative examples from the ID dataset, this should be explicitly stated, as it also relates to the concerns raised in Major Weakness 2 regarding evaluation protocol.", "was_revised": true, "final_justification": "Raise my rating following the extensive rebuttal with additonal experiments and discussion of current work, including favourable copmarisons.", "rebuttal": "We sincerely appreciate your constructive comments. In response to your feedback, we have provided detailed responses below. We hope our responses address your concerns and contribute to enhancing our work.\n\n**W.1 Missing many recent relevant works and experimental comparisons.**\n\nA.1 Thank you for bringing these outstanding works on zero-shot generated image detection to our attention. Following your kind suggestion, we have conducted an in-depth discussion and experimental comparison(ACC) of these references in our revised version. The experimental comparison between our method and these approaches is presented in the table below. Note that the code of ZED[3] is not publicly available, we are unable to conduct a direct comparison with our approach. Instead, we have included a high-level comparison with this method in the related work section.\n\nFirst, compared to these zero-shot works, we are the first to formulate generated image detection as an OOD detection task and theoretically demonstrates the generalizability and rationality of using models pre-trained on real images for generated image detection (as seen in RIGID[1], ZED[3], and our work).\n\nRegarding the comparison with RIGID[1], we share conceptual similarities - both utilize the DINOv2 model. However, whereas RIGID employs an intuition-driven noise-based approach, we derive our approach from the training objectives of self-supervised models. This foundational perspective enabled us to design a more effective differential energy scores, achieving better performance. \n\n“Manifold induce bias detection[2]” explores the biases of the implicit probability manifold, captured by a pre-trained diffusion model, which demonstrates both theoretical and experimental rigor. ZED[3] measures how surprising the image under analysis is compared to a model of real images. This closely aligns with our core concept: while ZED distinguishes real from generated images by analyzing the coding cost of lossless compression encoders trained on real images, our approach leverages visual self-supervised models trained on real images – drawing inspiration from human cognition.\n\nCompared to [2], our method shows marginal improvement in experimental results, which demonstrates enhanced generalization capabilities, notably aligning with the theoretical validation of our method's generalizability in Section 4.4. Even when compared to current state-of-the-art zero-shot detection approaches, our method maintains a discernible advantage in generalization capabilities.\n\n||Midjourney|SD V1.5|ADM|GLIDE|Wukong|VQDM|BigGAN|avg ACC|\n|-|-|-|-|-|-|-|-|-|\n|RIGID[1]|94.07|87.18|51.44|45.91|87.77|52.17|52.98|67.36|\n|Manifold[2]|55.45|63.00|57.27|88.31|65.39|76.86|77.56|69.12|\n|DEnD(ours)|84.44|70.12|90.66|92.23|72.11|92.25|96.91|85.53|\n\n**W.2 Incorrect experimental framing: The current experiments do not evaluate real vs. generated image detection directly. Instead, they perform OOD detection between generated images and a single real dataset (e.g., ImageNet or LSUN). Proper evaluation should treat all real images as in-distribution and generated images as out-of-distribution, regardless of which real dataset is used for calibration. Additional experiments are needed to confirm that the method generalizes across real domains — specifically, by calibrating the in-distribution (ID) on one real dataset and testing on a different real dataset treated as ID.**\n\nA.2 We follow previous works [5,6] to construct the datasets for evaluation when we conduct experiments on GENImage[4] and AIGCbenchmark[6]. However, we agree with your point that proper evaluation should treat all real images as in-distribution and generated images as out-of-distribution, regardless of which real dataset is used for calibration. Thus, we have conducted supplementary experiments to further verify the effectiveness of our method using the rigorous evaluation setting. We would like to highlight that, beyond ImageNet, all real datasets used in our experiments differ from DINOv2's training data.\n\nWe randomly sampled subsets from ImageNet, COCO, and LAION datasets to construct a novel test set of real data. After re-evaluating our method with this enhanced dataset, the results(AUROC) demonstrate that our approach maintains exceptional performance even when confronted with significantly more complex real-world scenarios.\n\n||BigGAN|Mask-GIT|RQ-Transformer|ADM|ADMG|DiT-XL-2|GilaGAN|LDM|styleGAN|avg AUROC|\n|-|-|-|-|-|-|-|-|-|-|-|\n|DEnD|99.53|98.62|98.58|92.71|82.36|70.43|95.58|83.59|91.07|90.28|\n\n**W.3 Clarity on novelty vs. prior work in method section: The method section should more explicitly differentiate between components borrowed from prior OOD methods and those introduced in this work. It would also be valuable to evaluate the proposed approach on standard OOD benchmarks, even if the expected performance is low — this would reinforce the claim that it is purpose-built for detecting generated images rather than general OOD tasks.**\n\nA.3 Thanks for your kind suggestion. In the method section, we first employ established lemmas from OOD detection theory to demonstrate the feasibility of using models trained on real images for generated image detection. We then discuss the limitations of directly applying existing energy-based OOD detection methods. The referenced methods and equations in this discussion are derived from previous works [7][8]. Following this analysis, we introduce our novel approach and present a theoretical theorem on its generalizability. In the revised version, we will add detailed clarifications to avoid potential confusion.\n\nAs for evaluate the proposed approach on standard OOD benchmarks, traditional OOD detection distinguishes In-Distribution (ID) and Out-of-Distribution (OOD) samples based on semantic labels (e.g., cats vs. dogs). In contrast, our formulation avoids semantic categorization. As introduced in Section 3.1, we define image patterns of real images as ID and those of synthetic images as OOD. This fundamentally diverges from conventional OOD detection. Consequently, our method is not applicable to traditional OOD detection benchmarks.\n\n**W.4 Pipeline presentation: While the theoretical formulation is clearly written, the practical method pipeline is difficult to follow. The paper would benefit from a visual figure or algorithm block summarizing the full detection process, from feature extraction to energy computation and thresholding. In particular, the role of the batch size N is unclear — since the detection method should operate independently on each image, the use of a batch suggests possible dependence on other samples. If the method compares the input image to negative examples from the ID dataset, this should be explicitly stated, as it also relates to the concerns raised in Major Weakness 2 regarding evaluation protocol.**\n\nA.4 Thank you for your kind suggestion. We will add algorithm block and a visual figure of the full process in the final version to more clearly illustrate our operational procedures. The detailed explanations are as followed. \n\nFirst, we shuffle the dataset to ensure randomness. For each sample x, we extract its normalized feature from DINOv2, then compute the inner product between this feature and those of the other N−1 samples in the same batch to derive the energy score. Subsequently, we apply random transformations to generate m(x), repeating the same process to obtain the energy score of the transformed sample. The final differential energy score is calculated by taking the difference between these two energy scores.\n\nRegarding the impact of batch size N, as discussed in Section 4.3, the role of batch size N is analogous to the number of negative samples in self-supervised models (Equation 5). We fully concur with your perspective that \"the detection method should operate independently on each image,\" which aligns with our implementation. Before detection, we perform random shuffling of the dataset, ensuring completely stochastic batch selection that does not rely on relationships between specific images. Although our method utilizes inter-sample information within batches during processing, this design preserves sample independence in detection. To address your concern, we conducted multiple experiments on the same dataset. The results demonstrate that the randomness of batch selection does not impact detection performance, confirming that our method does not rely on relationships between specific images.\n\nThe statistical significance measures of five repeated experiments on ImageNet are reported below：\n\nAUROC: Mean = 0.9481, Std = 0.00167, 95% CI = [0.94603, 0.95017]\n\nAP: Mean = 0.9333, Std = 0.00293, 95% CI = [0.92966, 0.93694]\n\n[1] Zhiyuan He et al., Rigid: A training-free and model-agnostic framework for robust ai-generated image detection.\n\n[2] J. Brokman et al., Manifold induced biases for zero-shot and few-shot detection of generated images.\n\n[3] Cozzolino et al., Zero-Shot Detection of AI-Generated Images.\n\n[4] Zhu et al., A Million-Scale Benchmark for Detecting AI-Generated Image.\n\n[5] Chen et al., DRCT: Diffusion Reconstruction Contrastive Training towards Universal Detection of Diffusion Generated Images.\n\n[6] Zhong et al., PatchCraft: Exploring Texture Patch for Efficient AI-generated Image Detection.\n\n[7] Fang et al., Is out-of-distribution detection learnable?\n\n[8] Liu et al., Energy-based out-of-distribution detection."}, {"review_id": "KTTdEo7ocR", "reviewer": "Reviewer_9kfu", "summary": "This paper frames the problem of AI-generated image detection as an out-of-distribution (OOD) detection problem, where generated images are the out-of-distribution and real (natural) images are in-distribution. Based on this formulation, the paper proposes a novel approach called differential energy-based detection (DEnD) that utilizes a well-known self-supervised model (DINOv2) which only has seen real images in its training phase. DEnD performs AI-generated image detection by calculating the difference of the pre-trained model energy of an input image and it's transformed version ($\\lambda$). Based on the theoretical work, real images exhibit lower $\\lambda$ values than generated images, making it a reliable representation for discerning real vs AI-generated images. Additionally, the paper provides guarantees of generalizability to unseen generative models through theoretical work, a key element missing in previous works. Finally, the proposed method shows strong performance on a variety of datasets and comparing with state-of-the-art baselines.", "questions": "I am willing to increase my score to accept or strong accept based on the authors' response to the following unanswered questions:\n\n1. How does the proposed method perform when there is a real data distributional shift between the training dataset of the pre-trained self-supervised model and real test data. For example, DINOv2 is trained on ImageNet, how does the proposed method perform on a dataset consisting of real images from COCO dataset? Is it going to mistake real images from other datasets as OOD (AI-generated) or is it robust to this distributional shift? If any, how significant is the performance drop in this scenario? \n2. How exactly is the threshold selected? What exactly does the validation data mentioned in section F include? How is the optimal threshold calculated? Importantly, how does the accuracy change as a function of the threshold? How sensitive is the accuracy to the validation data?\nWhen comparing with other methods, how the thresholds for those methods are selected?\n3. How does the proposed method perform on other types of video-generaton methods, such as LTX-Video [B] or Meta Movie Gen?\n4. How robust is the method to resizing, a very common post-processing operation? This should be added to section J.\n5. Why the evaluation metrics differ across different experiments? Why are all three metrics not reported in all experiments?\n6. How does the proposed method compare to FSD [B]? This is a recently published detection method which similar to this paper do not require AI-generated training data. Since I do not see their code being public, I think at least a high-level comparison in the background section is valuable. \n\n[A] HaCohen, Yoav, et al. \"Ltx-video: Realtime video latent diffusion.\" arXiv preprint arXiv:2501.00103 (2024).\n\n[B] Nguyen, Tai D et al. \"Forensic self-descriptions are all you need for zero-shot detection, open-set source attribution, and clustering of ai-generated images.\" CVPR 2025", "limitations": "I think the limitations should be discussed in more detail. For example, what are the real limitations and failure modes of the proposed method? Answers to some of the questions mentioned in the \"Questions\" section can be added to the \"Limitations\" to inform the reader of the real limitations of the proposed method.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 4, "strengths_and_weaknesses": "**Strengths**\n1. The paper addresses a timely problem of AI-generated detection through an under-explored perspective and addresses a fundamental limitation of existing works: Ensuring the generalizability of the detectors. \n2. The paper is clear, easy to follow and well-written. The flow of information is logical.\n3. Theoretical work is sound and ensures the proposed method's generalizability to unseen generative models under mild assumptions.\n4. The proposed method for AI-generated image detection is novel and well-motiviated and shows strong performance through experimental validation.\n\n**Weaknesses**\n1. Considering the method is \"training-free\" and utilizes DINOv2, which is trained on ImageNet, it is not clear how the proposed method performs when there is a real data distribution shift at test time.\n2. Although an important aspect for adoption the of proposed method to operational environments, the mechanism of selecting a threshold is ambiguous. It is unclear what does the \"validation\" data in section F include and how the optimal threshold is calculated. Additionally, the process of selecting a threshold for competing methods is not discussed. \nFor more weaknesses refer to the \"Questions\" section.", "was_revised": true, "final_justification": "The authors addressed all of my concerns in the rebuttal and are adding new experimental results accordingly to their paper (or the appendix). Therefore, I think the paper is in a better shape now and I raise my rating.", "rebuttal": "We are deeply grateful for your constructive suggestions. To address your insightful comments, we have meticulously prepared point-by-point responses below, all of which have been thoroughly integrated into the revised paper. We hope our responses address your concerns and contribute to enhancing our work.\n\n**W.1 It is not clear how the proposed method performs when there is a real data distribution shift at test time. For example, DINOv2 is trained on ImageNet, how does the proposed method perform on a dataset consisting of real images from COCO dataset?**\n \nA.1 We sincerely appreciate your in-depth and inspiring comments. This is inherently related to the potential performance degradation of our detectors under distribution shift scenarios. Following your valuable suggestion, we conduct supplementary experiments by replacing the ImageNet real data with COCO. \n\n||ImageNet|COCO|\n|-|-|-|\n|DRCT|90.36|85.13|\n|DEnD(ours)|94.81|89.84|\n\nWhen there is a distribution shift between the test data and the training data, a decline in performance is inevitable. The results confirm that while our method experiences limited performance degradation when confronted with this distribution shift, it maintains robust detection capabilities overall. Specifically, the AUROC decreased from 94.81% to 89.84% , demonstrating that our approach preserves reasonable robustness under domain shift conditions. This is consistent with your intuition. However, compared to the baseline, our method still achieves better results. In the future, we will continue to explore the impact of distribution shift on generated image detection.\n\nThanks again for this constructive feedback. Accordingly, we have included comprehensive analysis and discussion of distribution shift scenarios in our revised version.\n\n**W.2 Additionally, the process of selecting a threshold for competing methods is not discussed. \nWhen comparing with other methods, how the thresholds for those methods are selected?**\n\nA.2 We have added the following details in our experiments.\n\nRegarding the threshold selection for other competing methods, for a significant portion of these methods, we directly adopted the experimental results provided in their papers. For the remaining methods, we used the optimal thresholds discussed in their papers or the default thresholds provided in their open-source code.\n\n**Q.1 How does the proposed method perform when there is a real data distributional shift between the training dataset of the pre-trained self-supervised model and real test data.**\n\nA.1 Please refer to our response to Weakness 1.\n\n**Q.2 The mechanism of selecting a threshold is not ambiguous. It is unclear what does the \"validation\" data in section F include and how the optimal threshold is calculated. Importantly, how does the accuracy change as a function of the threshold? How sensitive is the accuracy to the validation data?**\n\nA.2 Thanks for pointing out this potentially confusing setting. \n\nIn the experiment, it is quite difficult to manually determine a suitable threshold through visual observation for two large datasets. To find an optimal threshold, we randomly separated 2,000 real and generated images as a validation set (with no overlap with the test set) and used an algorithm to identify the optimal threshold in the validation set. This threshold was then applied to calculate the accuracy on the test set.\n\nAs for our algorithm to identify the optimal threshold, we merge and sort two classes of data to generate candidate thresholds (midpoints of adjacent points), test both classification directions for each threshold, and select the median of thresholds maximizing correct classifications as the optimal threshold.\n\nBased on your valuable suggestions, we qualitatively analyzed the impact of threshold selection on accuracy using ImageNet, with results shown in the table below. It can be observed that a threshold score of 1.0 yields the highest accuracy on the test set. In our experiments, we used 1.0 as the optimal threshold for calculating accuracy on the test set. Our threshold selection is not sensitive to the choice of validation set; we conducted repeated experiments by randomly selecting validation sets multiple times and calculating the optimal threshold: 0.9403, 1.0125, 1.1845. In our reported results, we adopted 1.0 as the final threshold score. \nWe will include the above content in our appendix to avoid potential confusion.\n\n||th=0.8|th=1.0|th=1.2|th=1.5|th=2.0|\n|-|-|-|-|-|-|\n|ACC|77.14|86.09|85.24|73.92|\n\n**Q.3 How does the proposed method perform on other types of video-generaton methods, such as LTX-Video [1] or Meta Movie Gen?** \n\nA.3 We appreciate your constructive comments. We believe the following experiments and discussions can significantly improve the quality of our work. We have added the following results(AUROC) to our revision.\n\nTo further verify the effectiveness of our method, we consider the LTX-Video and Meta Movie Gen models that are highly advanced video generated models. Evaluating on these models would demonstrates the generalization ability of our method. Thus, we conduct experiments on these video generation models using the same experimental settings as for Sora. The results show that our method maintains strong generalization performance when handling these high-quality video generation models, which is a significant advantage of our approach.\n\n||LTX-Video|Meta Movie Gen|\n|-|-|-|\n|DRCT|90.22|94.17|\n|DEnD(ours)|92.41|97.20|\n\n**Q.4 How robust is the method to resizing, a very common post-processing operation?**\n\nA.4 Thank you for your kind suggestion. Resizing is indeed a common operation in robustness evaluation. In our previous experiments, most images had an initial resolution of 256×256, while datasets such as GENimage and Sora contained images with varying sizes. Due to the requirements of the DINOv2 model, all images were resized to 224×224 before being input to the model. Following your valuable suggestion, we have conducted additional experiments to evaluate the model’s performance when the input images are initially resized to 64×64, 128×128, 256×256, and 512×512. The results have been incorporated into Section J to address your concern.\n\nOverall, our method demonstrates good robustness against resize operations. However, it can be observed that when the original image is resized to 64x64, the detection performance experiences a relatively significant decline. This may result from the fact that a substantial amount of important information in the image is lost during this process, thereby affecting the detector's performance. In contrast, when the image is resized to 512x512, the key information in the image is largely preserved, allowing the detection performance to remain stable.\n\n||64|128|256|512|\n|-|-|-|-|-|\n|AUROC|86.57|89.16|94.81|93.06|\n\nThanks again for your valuable feedback. We have added the above results to our revision.\n\n**Q.5 Why the evaluation metrics differ across different experiments? Why are all three metrics not reported in all experiments?** \n\nA.5 Following previous works, we adopt AUROC and AP as the primary evaluation metrics. However, since some of our baselines also report accuracy, we include ACC as an auxiliary metric on certain datasets to remain consistent with these baselines. Due to space constraints, we do not report all three metrics for every experiment. The AUROC, ACC, and AP results of the main experiments presented in the paper are summarized below; following your suggestion, we will provide the complete evaluation metrics for these experiments in the appendix.\n\n||ImageNet|LSUN|GENImage|\n|-|-|-|-|\n|avg AUROC|94.81|96.05|92.97|\n|avg AP|93.33|95.03|91.05|\n|avg ACC|86.09|86.68|89.37|\n\n**Q.6 How does the proposed method compare to FSD [2]? This is a recently published detection method which similar to this paper do not require AI-generated training data. Since I do not see their code being public, I think at least a high-level comparison in the background section is valuable.**\n \nA.6 FSD[2] is also an outstanding work in the field of generated image detection, and it shares some similarities with our approach, i.e., using models trained on real images for generated image detection. We have included a high-level comparison with this method in the related work section of the final version:\n\nTo achieve generated image detection using models trained solely on real images, Nguyen et al. introduces a forensic self-description (FSD) framework that extracts forensic microstructures from images and models the distribution of real images with a Gaussian mixture model, whereas our method formulates generated image detection as an out-of-distribution (OOD) detection task, leveraging a self-supervised visual model pretrained on extensive real data. While our work shares similar goals with FSD, it differs in implementation approach.\n\n**L.1 I think the limitations should be discussed in more detail.** \n\nA.1 We appreciate your kind suggestion. We have refined the content in our limitations section based on the issues you raised.\n\n1. In this work, we employ the DINOv2 model pre-trained on extensive real-world data. However, when distribution shift exists between test data and training data, noticeable performance degradation occurs despite generally favorable experimental outcomes.\n\n2. Although our method demonstrates robust performance against high-fidelity generated images (e.g., Sora-generated content), it exhibits suboptimal detection efficacy for certain advanced generative models such as Stable Diffusion. \n\n[1] HaCohen, et al., Ltx-video: Realtime video latent diffusion.\n\n[2] Nguyen et al., Forensic self-descriptions are all you need for zero-shot detection, open-set source attribution, and clustering of ai-generated images."}, {"review_id": "1YJWpXKnvy", "reviewer": "Reviewer_P2GB", "summary": "This paper introduces a framework for detecting generated images by reframing the problem as an Out-of-Distribution (OOD) detection task. The authors propose Differential Energy-based Detection (DEnD), which leverages the differential energy scores computed via a self-supervised pretrained model (DINOv2). The core insight is that natural images (ID data) will have low differential energy scores, while generated images (OOD data) will have high scores. The paper provides theoretical guarantees of generalizability and conducts extensive experiments across several benchmarks (ImageNet, LSUN-BEDROOM, GenImage, AIGCDetectBenchmark, Sora). The results indicate that DEnD achieves state-of-the-art performance among training-free methods and often outperforms training-based detectors.", "questions": "- The authors compare DEnD’s performance across different self-supervised models (e.g., DINO, CLIP, DINOv2) and demonstrate DINOv2’s superiority. Given this dependence, could hybrid or ensemble approaches combining multiple self-supervised representations further improve robustness or mitigate reliance on a single model?\n\n- While the paper includes evaluations on various generative models, including some high-fidelity examples (e.g., StyleGAN-XL, Sora), can the authors provide a more focused analysis of cases where generated images are nearly indistinguishable from natural ones (e.g., Stable Diffusion or future models), and quantify how separation degrades in such scenarios?\n\n- Given the method’s reliance on differential energy scoring, how robust is DEnD to adversarial perturbations applied to natural images that could artificially inflate differential energy scores and lead to misclassification?\n\n- The paper presents extensive ablations and robustness tests but does not report statistical significance measures (e.g., error bars, confidence intervals, or variability across seeds). Could the authors clarify whether multiple trials were conducted and, if so, provide formal statistical analyses to support the reported performance?", "limitations": "See Weaknesses and Questions", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "**Strengths:**\n\n- The paper presents a fresh perspective by casting generated image detection as an OOD detection problem.\n\n- DEnD eliminates the need for task-specific training, relying on pretrained self-supervised models. This reduces training costs and mitigates overfitting risks.\n\n- The experiments cover a wide range of generative models, including unseen and unknown architectures (e.g., Sora).\n\n**Weaknesses:**\n\n\n- The success of DEnD is strongly dependent on the representational capacity of the selected pretrained model, particularly DINOv2. Although the authors provide comparisons with alternative self-supervised models (e.g., CLIP, DINO), these alternatives significantly underperform, confirming the reliance on DINOv2 and limiting flexibility in model choice.\n\n- While the theoretical framing—casting generated image detection as an OOD detection problem—is novel, the proposed method itself represents a relatively straightforward application of differential energy scoring using existing self-supervised representations. The algorithmic contribution beyond the reframing and score definition is incremental.\n\n- The method assumes that generated images consistently exhibit high differential energy relative to natural images. While this holds in many cases, there is no deep analysis or ablation to test this assumption against high-fidelity generative models or adversarially crafted fakes.\n\n- The code is not released at submission, and reproducibility relies heavily on future promises rather than current availability. Important hyperparameter choices (e.g., transformation distributions, thresholds) are not explored in depth.", "was_revised": true, "final_justification": "The authors have successfully addressed my concerns during the rebuttal phase. \n\nAccordingly, I have raised my final rating to 4 (Borderline accept).\n\nHowever, I am not an expert in the field of generated image detection, which makes it difficult for me to be certain that this score accurately reflects the paper's technical novelty. \n\nFor this reason, I have lowered my confidence score to 2. \n\nI hope the Area Chair will make the final decision based on the reviews from experts in the field.", "rebuttal": "We sincerely appreciate the time and effort you have dedicated to reviewing our paper, as well as your constructive comments. In response to your feedback, we have provided detailed responses below. We hope our responses address your concerns and contribute to enhancing our work.\n\n**W.1 The success of DEnD is strongly dependent on the representational capacity of the selected pretrained model, particularly DINOv2. Given this dependence, could hybrid or ensemble approaches combining multiple self-supervised representations further improve robustness or mitigate reliance on a single model?**\n\nA.1 Our method shows significant performance gain when DINOv2 is utilized. This is consistent with our motivation, namely, our OOD perspective for detection transforms the generalization challenge of generated image detection into the problem of fitting natural image patterns. Thus, DINOv2 showing relatively strong performance when fitting natural distributions can achieve better performance under various settings.\n\nMoreover, we would like to highlight that our method leverages both the representational capacity of DINOv2 and our designed differential energy score. As demonstrated in Appendix A, directly applying DINOv2 for detection yields suboptimal results. \n\nFollowing your kind suggestion, we conduct experiments incorporating features from multiple self-supervised models (CLIP, DINO, and DINOv2) and fusing them to mitigate the reliance on a single model. Aligning with your insightful comments, our experimental results on ImageNet demonstrate that integrating features from all three models yields superior performance compared to using CLIP or DINO features individually. We have added these results and discussions to our revision. Although performance degrades significantly when using CLIP or DINO alone, fusing features from multiple self-supervised models – as you suggested – can lead to some improvement.\n\n||DINO|CLIP|DINOv2|fusing|\n|-|-|-|-|-|\n|AUROC|69.21|75.42|94.81|82.13|\n\n**W.2 While the theoretical framing—casting generated image detection as an OOD detection problem—is novel, the proposed method itself represents a relatively straightforward application of differential energy scoring using existing self-supervised representations. The algorithmic contribution beyond the reframing and score definition is incremental.**\n\nA.2 First, our paper’s contributions are not limited to the design of the detection method. We make significant theoretical contributions by modeling generated image detection as an OOD detection task and providing a theoretical explanation for the generalizability of current zero-shot generated image detection methods, which utilize models pretrained entirely on real images to detect generated images. This is something no one has done in the field of generated image detection. \n\nSecond, although our method builds upon existing self-supervised and energy-based techniques[1], the energy-based OOD detection work[1] mentioned in our paper only served as an inspiration for our approach. Our differential energy-based detection is fundamentally different from [1].\n\nMore than that, our simple method significantly enhances generalization in generated image detection, achieving excellent detection performance even for high-fidelity images. Compared to prior work, our method requires no training, substantially reducing computational overhead while improving generalization. Such a simple yet effective approach can still make significant contributions to the field of generated image detection. For instance, reviewers 9KFU and SCX8 both affirmed the importance of our work in their comments. \n\n**W.3 The method assumes that generated images consistently exhibit high differential energy relative to natural images. While this holds in many cases, there is no deep analysis or ablation to test this assumption against high-fidelity generative models or adversarially crafted fakes.**\n\nA.3 Thank you for your suggestions! We have added discussions on the detection performance for high-fidelity images and an analysis of adversarially crafted fakes. As you pointed out, in a few cases, some highly realistic samples (e.g., those from Stable Diffusion) have scores that are quite close to those of real data, making them difficult to distinguish, which also leads to relatively poorer performance on Stable Diffusion in our experiments. However, overall, for most high-fidelity samples, such as those from Sora, Flux, and Meta Movie Gen, our detector can still output scores with high discriminative power, achieving excellent detection performance. For detailed content, please refer to our responses to Questions 2 and Question 3.\n\n**W.4 The code is not released at submission, and reproducibility relies heavily on future promises rather than current availability. Important hyperparameter choices (e.g., transformation distributions, thresholds) are not explored in depth.**\n\nA.4 We will release the code with an anonymous link.\n\nWe have thoroughly discussed and provided the selection of important hyperparameters used in our experiments in Appendices F, H, and I. In response to your valuable comments, we will highlight the details of hyperparameter choices in the main page. As our reported results primarily consist of AUROC and AP, these metrics do not involve threshold calculations. For a more in-depth discussion on thresholds, please refer to our response to Reviewer 9KFU regarding Question 2. \n\n**Q.1 could hybrid or ensemble approaches combining multiple self-supervised representations further improve robustness or mitigate reliance on a single model?**\n\nA.1 Please refer to our response to Weakness 1.\n\n**Q.2 While the paper includes evaluations on various generative models, including some high-fidelity examples (e.g., StyleGAN-XL, Sora), can the authors provide a more focused analysis of cases where generated images are nearly indistinguishable from natural ones (e.g., Stable Diffusion or future models), and quantify how separation degrades in such scenarios.**\n\nA.2 Our experimental results indicate that our detector achieves exceptional performance when handling low-generation-quality models such as BigGAN. For high-fidelity generated images (e.g., from Stable Diffusion and Sora), we do observe performance degradation. Notably, Stable Diffusion presented a significant challenge in our tests. However, this does not imply fundamental limitations in detecting high-quality generated content. As evidenced by our experiments on Sora and supplementary tests(AUROC) on models like FLUX, Meta Movie Gen and ltx-video[2], our method maintains robust detection capabilities even for state-of-the-art generations. In summary, while demonstrating strong performance against most high-quality generated samples, we acknowledge that exceptionally challenging cases like Stable Diffusion can cause noticeable performance reduction. We will prioritize enhancing performance on high-fidelity generative models as a key focus in our future work.\n||Sora|FLUX|Meta Movie Gen|LTX-Video|\n|-|-|-|-|-|\n|DRCT|82.53|91.10|90.22|94.17|90.22|\n|DEnD(ours)|90.22|92.87|92.41|97.20|92.41|\n\n**Q.3 Given the method’s reliance on differential energy scoring, how robust is DEnD to adversarial perturbations applied to natural images that could artificially inflate differential energy scores and lead to misclassification?**\n\nA.3 Thank you for your suggestions. Currently, most generated image detection studies do not address robustness against adversarial perturbations, which is also a critical metric for evaluating detectors. We experimentally evaluated our detector's performance(AUROC) on ImageNet when adversarial perturbations were applied to real images using FGSM. The results show a significant performance drop when adversarial perturbations are introduced, indicating that maintaining robustness against adversarial perturbations remains a challenge in the field of generated image detection. Thank you for your insightful feedback. We will consider improving robustness against adversarial perturbations as a limitation of our current work and a key focus for future research.\n\n||epsilon=0.01|epsilon=0.03|epsilon=0.035|\n|-|-|-|-|\n|DRCT|67.04|65.70|65.48|\n|DEnD(ours)|73.91|70.58|65.53|\n\n**Q.4 The paper presents extensive ablations and robustness tests but does not report statistical significance measures (e.g., error bars, confidence intervals, or variability across seeds). Could the authors clarify whether multiple trials were conducted and, if so, provide formal statistical analyses to support the reported performance?**\n\nA.4 Thank you for highlighting the need for statistical significance measures. We have updated the Appendix with these analyses.\nWe confirm that all experiments in our paper were conducted with five independent trials, and results were averaged. Due to the exceptional stability of our method (evidenced by extremely low standard deviations) and minimal stochastic influence, we did not originally include variability metrics in the paper. We have now calculated and present the statistical significance measures for experimental results on ImageNet below. The low standard deviations and tight confidence intervals indicate consistent model performance. Although our process involves some randomness in the random transformations, our repeated experiments demonstrate that our results are highly stable and minimally affected by this randomness. \n\nAUROC: Mean = 0.9481, Std = 0.00167, 95% CI = [0.94603, 0.95017]\n\nAP: Mean = 0.9333, Std = 0.00293, 95% CI = [0.92966, 0.93694]\n\n[1] Liu et al., Energy-based Out-of-distribution Detection.\n\n[2] HaCohen, et al., Ltx-video: Realtime video latent diffusion."}]

Author rebuttal:

Meta-review: The recommendation is based on the reviewers' comments, the area chair's evaluation, and the author-reviewer discussion. 

This paper studies AI-generated image detection through the lens of out-of-distribution (OOD) sample detection with a customized energy function as the detection metric. All reviewers find the studied setting novel, and the results provide new insights. The major concern of the initial submission was the lack of comparisons and discussions on the more recent training-free detection methods (e.g., RIGID, ZED, and the Manifold-based approach). The authors’ rebuttal and the additional results have successfully addressed the major concerns of reviewers. In the post-rebuttal phase, all reviewers were satisfied with the authors’ responses and agreed on the decision of acceptance.

Overall, I recommend acceptance of this submission. I also expect the authors to include the new results and suggested changes during the rebuttal phase in the final version.
Decision: Accept (poster)