Dual Data Alignment Makes AI-Generated Image Detector Easier Generalizable
Authors: Ruoxin Chen
Junwei Xi
Zhiyuan Yan
Ke-Yue Zhang
Shuang Wu
Jingyi Xie
Xu Chen
Lei Xu
Isabel Guan
Taiping Yao
Shouhong Ding
Venue: NeurIPS 2025 spotlight ()
Keywords: AIGC Detection
Primary area: general_machine_learning

Abstract: The rapid increase in AI-generated images (AIGIs) underscores the need for detection methods. 
Existing detectors are often trained on biased datasets, leading to overfitting on spurious correlations between non-causal image attributes and real/synthetic labels.
While these biased features enhance performance on the training data, they result in substantial performance degradation when tested on unbiased datasets.
A common solution is to perform data alignment through generative reconstruction, matching the content between real and synthetic images. 
However, we find that pixel-level alignment alone is inadequate, as the reconstructed images still suffer from frequency-level misalignment, perpetuating spurious correlations.
To illustrate, we observe that reconstruction models restore the high-frequency details lost in real images, inadvertently creating a frequency-level misalignment, where synthetic images appear to have richer high-frequency content than real ones. This misalignment leads to models associating high-frequency features with synthetic labels, further reinforcing biased cues.
To resolve this, we propose Dual Data Alignment (DDA), which aligns both the pixel and frequency domains. 
DDA generates synthetic images that closely resemble real ones by fusing real and synthetic image pairs in both domains, enhancing the detector's ability to identify forgeries without relying on biased features.
Moreover, we introduce two new test sets: DDA-COCO, containing DDA-aligned synthetic images, and EvalGEN, featuring the latest generative models. Our extensive evaluations demonstrate that a detector trained exclusively on DDA-aligned MSCOCO improves across diverse benchmarks. 
Code is available at https://github.com/roy-ch/Dual-Data-Alignment.

Dual Data Alignment Makes AI-Generated Image Detector Easier Generalizable
Ruoxin Chen', Junwei Xi² Zhiyuan Yan', Keyue Zhang', Shuang Wu', Jingyi Xie*, Xu Chen?, Lei Xu², Isabel Guan", Taiping Yao", Shouhong Ding' 'Tencent YouTu Lab, East China University of Science and Technology. PPeking University, *Renmin University of China, Shenzhen University, 'Hong Kong University of Science and Technology Corresponding Authors (cusmochen, taipingyao @treoooo@eeeecee etencent. com, eeguan@ust.
Abstract
The rapid increase in Al-generated images (AIGIs) underscores the need for de- tection methods. Existing detectors often trained biased datasets, leading to overfitting on spurious correlations between non-causal image attributes and real/synthetic labels. While these biased features enhance performance the train- ing data, they result in substantial performance degradation when tested on unbiased datasets. A common solution is to perform data alignment through generative recon- struction, matching the content between real and synthetic images. However, we find that pixel-level alignment alone inadequate, as the reconstructed images still suffer from frequency-leve misalignment, perpetuating spurious correlations. To illustrate, we observe that reconstruction models restore the high- feehfrryyency details lost in real images, inadvertently creating a frequency-level misalignment, where synthetic images appear have richer high-frequency content than real ones. This misalignment leads to models associating high-frequency features with synthetic labels, further reinforcing biased cues. To resolve this, we propose Dual Data Align- ment (DDA), which aligns both the pixel and frequency domains. DDA generates synthetic images that closely resemble real ones by fusing real and synthetic image pairs in both domains, enhancing the detector's s ability to identify forgeries without relying on biased features. Moreover, we introduce two new test sets: DDA-COCO, containing DDA-aligned synthetic images, and EvalGEN, featuring the latest gen- erative models. Our extensive evaluations demonstrate that detector trained exclu- sively DDA-aligned MSCOCO improves across diverse benchmarks. Code is available at httpt:tt//// htttpp:///itthbbl co
Dattaaaaaaaa-- Al inggetttt
Introduction
The rise of AIGIs 12 41 49
poses risks to digital security, including the potential for misinfor- 54 52 [7
mation, fraud, and copyright violations [12 20 [8 34
24 36]. This severe security issue underscores the urgent need for reliable detection methods to differentiate synthetic images
from authentic ones. Despite advances in AIGI detection techniques 4 32 35 the rapid evolution of generative models and the emergence of new architectures present cross-domain generalization challenges. This is especially evident in zero-shot scenarios involving previously unseen generation paradigms.
The generalizability of AIGI detectors is hindered by dataset biases 13
33
14
Existing datasets
often exhibit systematic discrepancies in attributes unrelated to the authority. Works (38) illustrate
semantic bias through word frequency analysis, and studies 35 demonstrate image size bias by
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Real Image
Synthotic Image
PNG
Dog
256
012 x 012
Dual Data Alignment
vB
16.3
Format Blas
Sementtcc Blas
Size Blas
JPEG
Dog
206 x 612
synthetic images are mistakanly classified as REAL X
LeWe7 SATE A4C
0602 MppecTarenics
Ou's
Figure I: Illustration of dataset bias. Top row:
Figure 2: Overall comparison between detec- tion methods on 11 benchmarks. Our model is exclusively trained on DDA MSCOCO data. The consistent outerrformance of DDA on 4 in-the-wild (Chameleon, WildRF, BFree-Onling
Real/synthetic images show disparities in format, content, and size. Real images are typically in JPEG, with varying sizes and centered semanties. Bottom row: Detectors trained on datasets con- taining these discrepancies are prone learning biased features, incorrectly associating authentic- ity with format, image size, or semantics.
and Synth and 7 manually-crafted bench- marks validates the generalizability. Detailed re- sults are provided Section
analyzing on the datasets where synthetic images are uniformly sized as multiples of 128 x 128. These non-causal features could be exploited by models to distinguish real from synthetic images, resulting in biased detector performance that fails to generalize across different datasets. Figure I visually illustrates such bias. Dataset alignment holds promise in addressing the issue of dataset bias by ensuring synthetic images closely resemble real ones, excluding authenticiny-related factors and directing detectors to focus on forgery-related cues. Specifically, studies [13] reveal systematic discrepancies in format and size biases: real images are JPEG-encoded and vary in size, whereas synthetic images are uniformly PNG-encoded and fixed in size. SemGIR [3]] DRCT [4], B-Free [4] aim to mitigate content discrepancies using diffusion reconstruction techniques that generate images semantically similar to real ones. Works [15] 55 [88] prevent models from learning semantics-dependent features by breaking images into patches and shuffling them.
However, in this paper, we ask: Does reconstruction truly eliminate potential misalignment and bias? Our answer is no. We find that although reconstruction-bitt based methods align datasets at the pixel level, they still introduce subtle misalignments at the frequency level. Specifically, generative reconstruction based data alignment tends preserve or even amplify details across all frequency bands. In particular, reconstructed images often restore are diminished real images-typically due compression during transmission or storage, where such components are removed to reduce file size because they have little impact on human visual perception. Consequently, synthetic images exhibit disproportionately strong high-frequency details, whereas real images contain much weaker ones, creating a noticeable discrepancy in the magnitude of high-frequency components rather than their semantic content. This spurious correlation can lead detectors to overfit these frequency cues, mistakenly identifying high-frequency richness as an indicator of synthetic origin.
components that
In this paper, we propose Dual Data Alignment (DDA), an effective technique that aligns synthetic images with real ones across both pixel and frequency domains. DDA consists of three steps: 1) VAE reconstruction for pixel alignment, 2) high- frequeeyyy fusion to eliminate bias, and 3) pixel mixup for further alignment in the pixel domain. As shown Figure a single model trained on DDA- aligned MSCOCO demonstrates significant improvements across benchmarks: +11.4% on Chameleon, + 26.6% % on EFree-Online and 19.4% % on EvaIGEN, with much lower fluctuations across subsets usually 1/2 that of baselines. We attribute this significant performance boost to the data alignment process: when synthetic images are carefully aligned with real images across key domains, the model Iearns tighter, more transferable decision boundary, enhancing generalizability

---

19m.1
PNG
512
1ym22
XPED
250
9yn33
PHG
512 S12
Sym
JPSQ
Real
JPSD
513
Syt
Syn
Syn.
Syn.
Syn.
Sym.
Alggndd Syn
Real
Reot
Real
Real
Deciatio Boundary Trained on Syn.1 Formet
Deciiton Boundary Truined on 2yn
Deciation Boundary Trained on Sprs
No Bias
Figure 3:
Visual illustration of how dataset bias affects decision boundaries. Left three panels: Detectors trained biased format, content, or resolution-tesd images carefully aligned with real images across multiple aspects, the model can learn tighter decision boundary that more accurately encompasses the real data.
synthetic images (e.g.. S-n.1-3) differ from real images in to learn spurious decision boundaries. Right: When synthetic
to unseen data, demonstrated in Figure Moreover, introduce two evaluation datasets: 1) DDA-COCO, a test set consisting of real images from MSCOCO and their DDA-aligned counterparts. This dataset evaluates whether the detector captures inherent discriminative features relies other biases. Prior detectors suffer significant performance drops on DDA-COCO. 2) EvaIGEN, a test set consisting of FLUX, Go',, Infinity, NOVA, and OmniGen, which includes both advanced auto-regressive and diffusion generators, serving for measuring detectors' generalizability under newly evolved generative models.
2 Related Works
AIGI Detection. CNNSpot 42 trains a vanilla CNN model, finding that detectors easily recognize synthetic images from seen models but struggle to generalize to unseen ones. UnivFD [3] employs CLIP as backbone, showing the improvements in generalizability in detecting unseen generators. Subsequent works (25] 38 55 50] explore model architectures and image preprocessing for more generalizable detection. CLIP enhances the pretrained CLIP backbone for AIGI detection by injecting 'real' and 'fake' concepts. Works 39
6.
23
19
57 exploit frequency domain artifacts, explores the upsampling artifact in
showing that frequency artifacts could well discriminate. NPR 40
generative models. Vision-languee approaches (27 17
26
5
46
45 pursue explainable detection
by leveraging VLMs' semantic priors. However, these methods' generalizability limited by either content bias or frequency-level bias, with a chance of exploiting non-causal features like image format, which degrade performance on unbiased test sets.
Dataset alignment. The evaluation bias issue in AIGI detection is firstly introduced in the work [33, showing that image format and size are common biases unintentionally exploited by detectors. FakeInversion (3) introduces a bias-reduced evaluation benchmark, mitigating thematic and stylistic biases by collecting synthetic images that match real images in both content and style. A line of subsequent works explores eliminating bias in the training set to enhance generalizability. SemGIR
[53 regenerates synthetic images by semantic-level reconstruction conditioned on the real counter- part's 's description, aiming to better align synthetic and real images semantically. DRCT [4] employs diffusion reconstruction for improved semantic alignment. B-Free [4 addresses dataset bias through self-conditioned inpainted reconstructions and content augmentation. However, this inpainting paradigm can alter the center object, corrupting the semantic alignment. AlignedForensies [K] per- forms simple VAE reconstruction without latent space manipulation, resulting in synthetic images that closely match real images in semantics and resolution. However, both B-Free and AliinedFFoensies overlook format alignment, creating space for JPEG-based shortcuts in discrimination.
3 Methodology
3.1 Motivation and Analysis
Misaligned Dataset. In the absence of additional supervision, detectors rely exclusively on training set to learn the concept of 'real' versus 'synthetic'. When these two classes' data differ systematically con-causal attributes- such as compression format or semantic content-the model may incorrectly learn to associate these irrelevant features with authenticity. These spurious signals
3

---

High-Frequency
High-Frequency from VAE Rec.
High
Hig
(IPEG 75)
(PNG)
(PNG)
(PNG)
(PNG)
(PNG)
Figure 4: Visualization of frequency domain energy using 2D DCT. The left column shows real image, while the remaining columns display images reconstructed by VAEs from various Stable Diffusion models. The grids represent frequency components, with the top-left and bottom-right indicating low- and high-frequency regions, respectively. Lighter areas correspond to higher energy. Real images in JPEG format exhibit darker high-frequency regions compared to VAE reconstructions, indicating weaker high-frewe fegg-frequency content in real images.
200
VAE Rec.
High-Freq, Masked VAE Rec.
-58.0%
syotheti
50
90.00
15.0%.3.0%400000
FTEMA 19.0%
38.0% 25.00%%%5.0%
41.0720.000 www.000......
16.0%
SOXL
FTMSE
5021
Figure 5: Evidence for the existence of biased frequency-based features to discriminate re- constructed images. We apply a binary mask to the DCT coefficients, systematically nullifying high-frequency components where either the horizontal vertical frequencies exceed 95%, 90%, 85% and 80% of their respective spectral ranges generate High-Freq. Masked VAE Rec.
often more salient than subtle, genuine artifacts that actually distinguish real from synthetic images, making more difficult for the model to learn truly generalizable features.
Reconstruction- Alignment. To align synthetic images with real ones, approaches 53 59 [4] employ txt2img generative models to generate images with similar semantic content, conditioned the image label image captions obtained through pretrained models. However, images generated using this approach often differ from the originals due to the lack of strong and detailed supervision, which prevents the generated images from fully matching the original images in all semantic details. DRCT 4 [4] leverages Img2lmg diffusion reconstruction, directly using the image itself guide the reconstruction of real image into synthetic counterpart & as follows:
t Decoder(S 2). where 2 =
t),
(ncoder(x)).
(1)
where 2 represents the encoded latent the real image. while is modified by adding noise and subsequently denoising, creating
latents that subtly differ from 2. However, such self-supervised diffusion reconstruction can still lead to changes image details due to modifications in the latent space, which responsible for the generation of semanties. The work (33] further simplifies the reconstruction process by using a Variational Autoencoder (VAE)-a submodule used all stable diffusion generators- withhou without any modification to the latent. This approach generates images that closely match the original real image at the pixel level.
f Decoder(2), where
Encoder(z).
(2)
Frequency-Level Misalignment Exists and Can Be Exploited. Frequency domain has been widely explored in AIGI detectors 337 23
demonstrating that frequency information is crucial for AIGI detection. This motivates us to revisit the frequency-domain alignment. Sur- prisingly, despite pixel-level alignment, synthetic counterparts exhibit significant discrepancies in high-frequency content. Figure visualizes this discrepancy between the real image and synthetic images reconstructed using various VAEs. Real images are often with relatively poor high-frequency information, which is due to JPEG compression removing high-frequency details. Having identified this frequency-level discrepancy, another question arises: "Can this disparity leveraged, or are we overestimating its impact?" To evaluate its effect, assess the impact by measuring the variance in
30 48

---

VAE Reconstruction
DDA
Freq. Bias
Freq.
Freq. Alignment
Level
Freq.
Freq.
Pixel
Level
Real
Freq, Aligned
Figure 6: DDA pipeline. Left: VAE-reconstructed images differ from real ones in the intensity of frgh-frrquency components. Right: DDA fuses high-frequency information from real images into the VAE-reconstructed images to align them in the frequency domain. Then, DDA uses pixel-level mixup of real and seuuueccy-lligned images to further align them in the pixel domain.
DDA
WAE Rec.
Inpaint
Real
DDA
VAE Rec.
Diff. Rec.
Inpaint
T2I
Ice
SD15
44.4+0.0
65.3+0.0
208.9 114.5
112.8 16.5
5792.5+3.7er
SDXL
2133.5+0.0
3533.7x0.0
3737
5318.1
4196.247.co5
6325 5.6660
High Prrs
SD21
72.310.0
431.010.0
1053.8:524.5 1207.61 007.6611499) 114.4.7=1.3c7
Figure 7: Comparison of various image processing methods based on loss with respect to the real image. Left: Comparison of image processing methods series (SD15, SDXL, SD21) displaying real images alongside processed versions using DDA, VAE reconstruction (VAE Rec.), diffusion reconstruction (Diff. Rec.), masked inpainting with prompts (Inpaint), and text-to-image generation (T2I). Mean squared еттоr (MSE) values relative to the real image are presented beneath each processed image, and each mse value is calculated by generating 100 images. Right: Visualization of relative error metrics for each processing method across the same model series, segregated into low frequency and high frequency bands calculated using discrete Fourier transform (DFT). Bar charts illustrate comparative eтrоr magnitudes across different reconstruction techniques and frequency components. Both pixel-level and frequency-level analyses indicate that DDA produces synthetic images most similar to the real images.
three Stable Diffusion model
detector performance on VAE-reconstrructed images. As shown in Figure 5 the empirical results striking: visually identical VAE-reconstructed images are detected by the frequency-basee detector SAFE P3 with a 93% success rate, indicating significant difference in the frequency domain. How- ever, when we mask high-frequenc, information slightly, the detection rate drops dramatically. This substantial decline cannot be attributed solely to information loss; rather, it suggests that detectors exploit biased features specifically, the richer their not undergoing JPEG compression, unlike real images.
details in synthetic images due to
3.2 Dual Data Alignment
Motivated by the previous observation, we propose DDA, technique that generates synthetic images aligned with real ones both the pixel and frequency domains to mitigate the learning of biased features. As illustrated in Figure DDA consists of three steps: 1) VAE Reconstruction: Generate

---

Real
Txt2lmage
Diffusion Rec.
VAE Rec.
DDA
FT-MSE
FT-EMA
SDXL
SD21
Figure 8: t-SNE visualizations comparing real and generated images, illustrating the proximity of synthetic image cluster centers to real images in feature space. The ordering of proximity-froom closest to farthest- is: DDA, VAE reconstruction, diffusion reconstruction, and satt-to-imae (T21) generation. These results indicate that DDA produces synthetic samples most closely aligned with real images near the data manifold boundary, thereby facilitating the learning of tighter and more generalizable decision boundary.
pixel-wise similar images containing VAE-specific artifacts. 2) Frequency-Level Alignment: We identified that discrepancies in the frequency domain primarily arise from JPEG compression. To mitigate this, align the frequency by applying the same JPEG compression with equivalent quality factor to both real and VAE-reconstructed images. In practice, we estimate the quality factor of each real image before training and apply the same compression its reconstructed counterpart during training. 3) Pixel-Ievvl Alignment: Apply mixup between real and frequency-aligned images ensure pixel-domain alignment. A closely aligned synthetic image is generated follow:
mmix
Tpizel
Freat + (1 - --pzee) Teyn-
(3)
where Tpizel E [0, 1] controls the degree of pixel-level alignment. A higher Spinet value yields a closer synthetic image in the pixel space. In practice, Tpizel is sampled from uniform distribution U(0 Rpizel). Together, these steps ensure that the resulting synthetic images preserve generative artifacts while maintaining close alignment with real data, both spectrally and spatially.
The generalizability of DDA built upon two foundations: 1) VAE artifacts generalize across generators. Because VAE-reconstructed images are the closest synthetic counterparts to real images, decision boundaries learned from these pairs are likely to remain effective for distinguishing other, more distant synthetic variants (e.g., those from text-to- rext-to-image generators). Moreover, since the VAE decoder is typically the final stage in diffusion- subsequent modules. 2) Dual-domain alignment mitigates dataset bias. By aligning synthetic images with real ones in both the frequency and pixel domains, DDA reduces real-synthetic discrep- ancies more effectively than alternative reconstruction based methods. In particular, it eliminates high-frequency bias commonlly introduced by compression or generative artifacts Icaddingt to stronger generalization and reduced reliance spurious features.
generators, its artifacts are less influenced by
Comparison to Dataset Alignment Methods. We validate that DDA creates the closest real- synthetic image pairs when compared other alignment methods from the following three viewpoints: 1) Pixel domain: Left of Figure shows that DDA-aligned images lead to minimal MSE loss compared to the original image; 2) Frequency domain: Right of Figure shows that DDA-aligned images are most similar to the original image in frequency space; 3) Feature domain: Figure & validates that the cluster center of DDA -Dl-alig images is closest to the center of real images.
4 Experiments
4.1
Experimental Setup
Datasets All compared detectors evaluated eleven diverse datasets, including seven bench-
mark datasets (GenImage [59]. DRCT-2M (4. Synthbuster []] DDA-COCO, EvaIGEN, AIGCDetec-
tionBenchmark [56) and ForenSynths 4 and four in-the-wild datasets (Chameleon 48). WildRF
(2). SynthWildx 7 and BFree-Online
[4] ), where images are sourced from the web. These datasets
contain real images from different sources and various generators, including diffusion models, GAN models, auto-regressive models, and other unknown models. They differ in format, content, and resolution, thereby minimizing evaluation bias. Table Toulines the datasets' details.

---

Table 1: Overview of the evaluation benchmarks. "SD" denotes Stable Diffusion and "AR" denotes rego--eeressive models. The diversity of data sources and generator types along with four bench- marks collected from in-the-wild data with unknown generators and peass-proesiingeeneeeee the overall evaluation more accurately reflects a detector's generalizability and practical applicability.
that
Derave
Source
Types
DDA-COCO (ouns)
5K225K
MSCOCO
EvaIGEN
0/2765
Genlinage
45KA6K
Imagrhvet
& CIAN SD SD SD & GAN GAN Enknown Enkanon SD unEESWAT
DRCT-2M 9
SKARDK
MSSO0C
16
Systhinsic
1KAK
RAISE
X3
76,25K776.22 25K
LSUN & MSCODO ImageNer & CelebA, ITTQQ
17
PorenSymite
36, 26.38236.22 2K
LSUN & MSCOCCO lmageNerr& & ColehA others
Chameleon
05
14 (459771 22K
Interner
unitnown unknown
WILURE
500/500
Redäl. FB.
SyuthWikk
300V 1.5
X
BFrec-Ooline
1033641
Interre
unkoown
Table 2: Overall comparison across 11 benchmarks. To ensure fairness and reproducibility, we use official checkpoints released by each method. We exclude B-Free [14] from this comparison due to the unavailability of public code. JPEG compression with quality factor of 96 is applied to the synthetic images in Genlmage, ForenSynths, and AJGCCeetectionBencccar to mitigate format bias. The number of generators used in each dataset reported below the dataset name, where G refers to GANs, D to Diffusion models, and AR to performance per column; underlined numbers indicate the second-best.
models. Bold numbers indicate the best
Gedtrees
1ICT:3M
DCA--0000
Currcioon
System Mt.
Eetor Ooline
104
IeD
-0
10x 228
110
181
Unioves
5.5A 6.3
335 11.8
613 2.4
28.422 233
Saur 36
4788 22.6
53.14 13.3
48.3
413
63.5 11.5
40.5
46.13 18.
30
5851-15
103
013 102
12:44
455 26.
203 1-53
30)-1 11
503
-6.1 072
01.0 114
$1.5
452-11 12.
11
00.--1
172 2-1
118
01-88
315
11.5
12.- 1.4
M35-3-3
2321
18.
38.4
1413
11.3
3148
055 125
DDA-COCO and EvaIGEN DDA-COCO consists of five subsets containing reconstructed images of MSCOCO 28 validation set by different VAEs, utilizing frequency- alignment. We construct the EvaIGEN dataset using the five latest text-to-image (T2I) generators using aligned prompts from are the first work to involve auto-regressive-bate generators for image forensics in the AIGI detection field. Specifically, we introduce each generator as follows: (1) Flux [22]: the SOTA diffusion-based generator, offering extremely nigher-resolution output images. (2) GoT [10] A multimodal model combining LLM and diffusion processes to enable baasoning-guided image generation. (3) Infinity [16): A bitwise auto-regressive model using infinite-vocabulary tokenization and self-correction for faster and higher-fidelin image generation. (4) OmiGen [44): A unified multimodal framework capable of handling diverse image generation tasks within a single, simplified architecture. (5) NOVA [9]: A non-quantized auto-regressive model designed for efficient image and video generation, achieving high fidelity with reduced computational overhead. These models allow our EvalGEN to serve as a very high-quality benchmark for evaluating the generalizability of detectors on unseen generators.
the GenEval benchmark [11]. Notably,
T2I
Implementation Details We use DINOy2 as the backbone and fine-tune it with LoRA, using a rank of 8. The input resolution is set to 336x336, employing random cropping during training and center cropping during validation. Padding is applied when the image height or width is insufficient. The training data exclusively consists of MSCOCO 29 images and their DDA-aligned counterparts. During VAE reconstruction, to ensure that the reconstructed image size matches the real one, we first center-crop each image to the largest size that is a multiple of 8, following the VAE model's design. For frequency alignment in DDA, we apply the same JPEG compression to each reconstructed counterpart with a 50% probability during training, allowing the model to encounter both JPEG and PNG formats of synthetic images. All evaluations are conducted using a single model without any datuset-specificc fine-tuning or threshold adjustments.
Evaluation Metrics and Comparative Methods Unless otherwise specified, we report balanced accuracy, the average of real and fake accuracies, as the evaluation metric, following works [8] 32
31
23
38
48
33
14] The methods compared include four frequency-based detectors: NPR
SAFE
23
and AIDE A ; three CI.IP-based detectors: UnivFD [2], Fatformer [31] and
C2P- CLIP
38
and two data alignment methods: DRCT 4 and AlignedForensies [33]
7

---

Table 3: Comparison of balanced accuracy between DDA and compared methods on DRCT-2M.
Minbed
LDM
30h1-
$2h12
1:4mm
Tuams
Tem
10h:1
0700)
014
-44
188
Arg
211
813
013
18.5
18.5
21.1
21-
812
0.3
15.5
11.3
01/3
071
EAT meee
20.3
511
910
818
493
X31
13.0
18.3
0111
18.3
590
56.3
18.3
18.4
913
0533
18.5
063
863
94.
194
02-4
18.
114
815
024
18.
124
06.
636
37.4
002 4-74
Table 4: Comparison of balanced accuracy on Genlmage.
Methel
Miljoumny
SDv1.4
SDv1.5
ADM
GLIDE
Wakcong
VQDM
BigGAN
Avg.
534
55.1
43.8
41.2
48.4
57.7
6.3
UnidFD
55.1
55.6
62.5
76.0
54.4
Fatformet JONPEP
52.1
SAFE 200/25
49.0
-9.7
49.8
49.5
50.3
50.2
50.9
C2P-CLIP 1aAdEN
56.5
77.5
76.9
71.6
73.5
79.4
73.7
85.9
74.4
AIDE m2u 48
38.2
77.2
77.4
50.4
54.6
70.5
50.5
50.6
61.2
11.9
DRCT andite
82.4
88.1
88.2
76.9
$6.1
87.9
85.4
87.0
84.7
2.7
AlignedForeniio
97.5
99.7
99.6
524
57.6
99.6
75.0
50.6
79.0
22.7
DDA (ours)
95.5
95.7
98.6
89.5
89.6
96.7
76.5
36.5
91.7 1.7.
Table 5: Comparison of balanced accuracy on AIGCDotecttonnBechhaat
2011
2013
Raling
Prp
083
360
183
81.
122
215
360
384
0.6
383
-44
284
31-0
88.3
08.3
512
820
159
321
Table 6: Comparison of balanced accuracy between DDA and compared methods on ForenSynths.
Nanel
CBN
CycoGAN
Dupfik::
CaICAN
P4LI
PYGAN
54N
SecayDott
SarCAN
$20KAN
W1R
Arg
1-4
X-1
176
19.1
$5.2
55.1
68.2
BATE
13.2
21-8
36.1
11.8
23.0
23/0
500
3111
331
23.3
23.3
311
801 2-27
85.6
164
51.5
01.8
$1.0
53.0
315
Alprodiem wet.br mi
012
904
717
40.8
532
37A
555
23.
15.3
559
$55-2T1
270
363
M6T
723
321
4.2 Cross-Dataset and Cross-Model Comparison
Overall Comparison on 11 Benchmarks. Table 2 presents a comprehensive comparison across 11 datasets-7 manually curated and 4 hea--willd--orrrinn most known open-source AIGI evaluation benchmarks. To the best of our knowledge, the first large-scale comparison of its kind. As benchmarks vary greatly, the benefits of exploiting any bias are minimized, making the average accuracy across the 11 benchmarks more representative of the detector's 's practical performance. The results show that: 1) DDA achieves an average accuracy 90.7%, marking 15.7% improvement over the second-best method. Notably, DDA reaches 82.4% accuracy on the challenging Chameleon benchmark, where only AlignedForensics achieves above 70%: 2) DDA also has the highest minimal accuracy of 81.4%. significantly outperforming the second- method by 27.5%. Moreover, DDA exhibits the smallest deviation across benchmarks, less than half of the other methods, suggesting it is more reliable and robust; 3) An interesting observation is that, when comparing methods across datasets, detectors trained on more aligned data tend to achieve much higher average accuracy. The degree of data alignment in the detectors, in increasing order, is as follows: UnivFD (no data alignment), DRCT (data alignment via diffusion reconstruction), AlignedFooensics (data alignment via VAE reconstruction), and DDA (dual-domain data alignment). The overall average accuracy follows the same order as the degree of data alignment. This clearly demonstrates the effectiveness of data alignment in improving detector's generalizability, supporting our previous assertion that data alignment helps models learn more transferable decision boundariess.
Detailed Comparison on DRCT-2M, GenImage, AIGCDetectionBenchhnai Synthbuster, SynthWildx, and WildRF. Table Table 8able8rres report the detailed performance of various methods across these subsets. From the results, we observe the following: (1) Consistent superiority: DDA not only surpasses other detectors by substantial margin in average accuracy (ranging from 3% to 10%) but also achieves consistently lower deviations across all benchmarks. Given the diversity of real image sources and the inclusion of both GAN- and diffusion based models,
ForenSynths,
8

---

Table Comparison of balanced accuracy between DDA and compared methods on Synthbuster.
Malled
DALLEE
DALLEE 3
Facely
GLIDEE
Midjounzy
5D
SD
1.4
SD
SDXI
Avg
NPR Jcvers
8
51.1
49.3
86.5
52.8
31.4
51.8
46.0
-2.8
50.0
2: 2.6
UnaFD comme
$13
47.4
85.9
32.5
70.4
75.7
68.0
67.3 2: 1444
Ralfomer 20m
69.1
auerss
CPPCCLP
DRCT
Allnediwrensss. racuaroO
50.2
DDA (ours)
86.3
90.8
91.9
76.5
91.5
92.9
91.3 93.5
9L.1
Table 8: Comparison of balanced accuracy between DDA and compared methods on Synth Wildx and WildRF.
Method
SyuthWilxx
WildRF
DALL-E3
Firefly
Midjoumey
Facebook
Roddit
Twitter
NPR 24
Uni comres
PatFormer
46.5
61.6
48.3
$2.1
54.1
68.1
54.4
$8.9 800
SAFE Ko0r25
33
49.4
48.2
49.5
49.1 = 0.7
50.9
74,1
37.5
572 18.5
C2P-CI IP Mag
18
56.9
61.4
$3.0
57.1 - 4.2
54.4
68.4
55.9
596 -
AIDE 20
48.
45.8
AllinalForendie (C18225
92.2
78.8
17.8
81.8
80.1
DDA (ours)
92.3
87.3
93.1
90.9
93.1
86.4
91.5
90.3 3.5
Table 9; Comparison of balanced accuracy between DDA and other methods DDA-COCO.
Table 10: Comparison of balanced accuracy EvaIGEN.
71.
844
413
14
412
18.3
31.8
435
SAFE men
413
370
118
94.
12.5
48.3
6.3
81
8.
11.3
123
813
these results strongly demonstrate the effectiveness and generalizability of DDA. (2) Exception on ForenSynths: DDA underperforms slightly on the ForenSynths benchmark. We attribute this to the fact that the two methods outperforming DDD-FFaformer and C2P-CLIP- ProGAN, which is also the generator used in the ForenSynths subsets, giving them advantage. Moreover, some data in the ForenSynths are generated by older and smaller models, which deviate significantly from modern generators, contributing to DDA's performance degradation.
trained on
Comparison DDA-COCO and EvaIGEN Table 9 and Table 10 report accuracies two proposed benchmarks, DDA-COCO and EvaIGEN, respectively. We observe the following: (1) Generalization across diffusion models: DDA, trained solely on SD 2. 2.1-reconstructed data, generalizes well to other diffusion models and exhibits a smaller standard deviation. This suggests that DDA learns universal upsampling artifact shared across diverse generative models, reinforcing claim that data alignment enhances generalizability. (2) Effectiveness of data alignment: Results on DDA-COCO highlight the importance data alignment. Methods lacking explicit alignment-such as NPR 8. UnivFD (32), FatFormer (31, C2P-CLIP (38 AIDE (88) and SAFE (23 exhibitt large
disparities between real and fake accuracies, revealing underlying dataset biases. (3) Performance on
emerging generators: DDA also achieves SOTA on EvaIGEN, excelling on auto-regressive generators, further validating its strong cross-ardes cross-architecture generalizability.
Comparison on Generation Time Cost We compare three methods which introduce train data generation-Dee -DRC 4) AlignedForensies B3] and B-Free [14]. Table [I presents the number of real and synthetic images used training, generation method and the estimated reconstruction time (Single Image & Full Set) using each method, which is tested by generating 100 synthetic images. Results show that our DDA requires the least amount of training data and reconstruction time, confirming its effectiveness and efficiency in terms of training cost.

---

Table 11: Comparing on data generation time,
Method
Real Fake
Generation Method
Time Per Image
Full Construction Time
DRCT
118K /354K
Diff. Rec.
0.6569 0.0050
64.6 h
AlignedForensies
179K / 179K
VAE Rec.
0.1756
0.0692
8.73 h
51K
DIY. Inpaint.
3.0150
0.0125
258.79
DDA (ours)
118K / 118K
VAE Rec.
DDA
0.1792 0.0704
5.9
NPR
UnivFD
FatFormer
SAFE
C2P-CLIP
AIDE
DACT
AlignedForensics
DDA
100
Balanced (%)
Balanced Acc (%)
80
80
80
60
Balanced
40
40
40
20000
80
70
0.5
1.0
1.5
2.0
0.0
0.5
1.0
1.5
2.0
JPEG Quality Factor
Resizing Scale
Blurring Sigma
Figure 9: Robustness analysis on Genlmage.
Accurscy (88)
100
Balanced Accuracy 180
100
Balancod Accurccy 18
2000
9o
90
90
eo
80
70
60
60
50
0.0
0.2
0.4
0.6
0.8
1.0
50
0.0
0.2
0.4
0.6
0.8
1.0
50
50XL PT.EMA FT-NSE 5D21 5035
Impact of P piieet
(b) Impact of Rpiieel
(c) Impact of VAE
Figure 10: Ablation studies. (a) Ppizel probability of applying pixel-level alignment; (b) Ryizel! upper bound for sampling the pixel mixup ratio; (c) VAE: backbone used for training data reconstruc- tion. Results show the impact of each hyperparameter the performance of DDA.
4.3 Evaluation on Robustness
Figure 9 shows the results of three robustness evaluations on the GenImage-JPEG96 dataset for all compared methods. Results show that: (1) DDA shows strong robustness across all three post- processing methods, outperforming the second-best method by 10.5%, 4.1 %, and 5.7% under JPEG 60, RESIZE 2.0, and BLUR 2.0, respectively. (2) Methods lacking alignment, such NPR (8), SAFE (33, and AIDE (48), demonstrate poor robustness under JPEG compression and resizing. In contrast, methods with alignment perform much better, emphasizing the importance of data alignment.
4.4 Ablation Studies
Figure IO illustrates the impact of Ppizet- Rpizel, and the choice of VAE training data generation. Results indicate that the detector maintains consistent accuracy when Ppizee and Rpizel are between 0.2 and 0.8, with performance drops observed at 0.0 and 1.0. Experiments with different VAEs confirm that SD21 is the most effective choice.
Conclusion
In this paper, we demonstrate that pixel-domain alignment alone is insufficient for fully aligning real and synthetic image pairs. Building on this, we propose DDA to align synthetic images with real ones across both pixel and frequency domains, thereby mitigating bias. We also introduce two AIGI benchmarks: DDA-COCO and EvaIGEN. Extensive experiments across eleven benchmarks demonstrate the consistent superiority of DDA. We believe that DDA, DDA-COCO, and EvaIGEN provide solid foundation for advancing the generalization of AIGI detection.
Limitations and Future Work While DDA demonstrates strong performance across extensive benchmarks, there remains gap in its application to real-world scenarios, particularly due to the heavy post-processing applied images such contexts. In practice, we observe that even authentic photos taken by smartphones may exhibit synthetic-like artifacts, likely resulting from the Al-based enhancements embedded modern smartphone camera pipelines, which adds complexity to real- world AIGI detection. In future work, we plan to develop more practical AIGI detector tailored to address these real-world challenges.
10

---

6 Acknowledgements
The authors would like to express sincere gratitude to NeurIPS anonymous reviewers for their constructive feedback. This work is supported by the National Natural Science Foundation of China under Grant 62572188 and Grant 62272164.
References
[1] Quentin Bammey. Synthbuster: Towards detection of diffusion model generated images. IEEE Open Journal of Signal Processing, 5: 5:1-9, 2023.
[2] Bar Cavia, Eliahu Horwitz, Tal Reiss, and Yedid Hoshen. Real-time deepfake detection in the real-world. arXiv preprint trxiv:2406.09398. 2024.
[3] George Cazenavette, Avneesh Sud, Thomas Leung, and Ben Usman. Fakeinversion: Learning to detect images from unseen text-to-image models by inverting stable diffusion. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 10759-10769, 2024.
[4] Baoying Chen, Jishen Zeng, Jianquan Yang, and Rui Yang. Dret: Diffusion reconstruction contrastive training towards universal detection of diffusion generated images. In Forty-first International Conference on Machine Learning, 2024.
[5] Yize Chen, Zhiyuan Yan, Guangliang Cheng. Kangran Zhao, Siwei Lyu, and Baoyuan Wu. X2-dfd: A framework for explainable and extendable deepfake detection. arXiv preprint arXiv:2410.06126. 2024.
[6] Beilin Chu, Xuan Xu, Xin Wang, Yufei Zhang, Weike You, and Linna Zhou. Fire: Robust detection of diffusion- -eenrratee images via rrquency-guiiee reconstruction error. CVPR. 2025.
[7] Davide Cozzolino, Giovanni Poggi, Riccardo Corvi, Matthias Nießner, and Luisa Verdoliva. Raising the bar of ai-generated image detection with clip. Proceedings of the IEEF/CVF Conference Computer Vision and Pattern Recognition, pages 4356-4366, 2024.
[8] Davide Cozzolino, Giovanni Poggi. Matthias Nießner, and Luisa Verdoliva. Zero-shot detection of ai-generated images. In European Conference on Computer Vision, pages 54-72. Springer, 2024.
[9] Haoge Deng, Ting Pan, Haiwen Diao, Zhengxiong Luo, Yufeng Cui, Huchuan Lu, Shiguang Shan, Yonggang Qi, and Xinlong Wang. Autoregressive video generation without vector quantization. arXiv preprint 241.:24412.,419,,, 2024.
[10] Rongyao Fang, Chengqi Duan, Kun Wang. Linjiang Huang, Hao Li, Shilin Yan, Hao Tian, Xingyu Zeng, Rui Zhao, Jifeng Dai, et al. Got: Unleashing reasoning capability of multimodal large language model for visual generation and editing. arXiv preprint arXiv:2503./0633 2025.
[11] Dhruba Ghosh, Hannaneh Hajishirzi, and Ludwig Schmidt. Geneval: An object- focused framework for evaluating text-to-image alignment. Advances in Neural Information Processing Systems, 36:52132-522155 2023.
[12] Ian Goodfellow al. Generative adversarial nets. In Advances in Neural Information Processing Systems, 2014.
[13] Patrick Grommelt, Louis Weiss, Franz-Josef Pfreundt, and Janis Keuper. Fake or jpeg? revealing common biases in generated image detection datasets. arXiv preprint arXiv:2403. /7608, 2024.
[14] Fabrizio Guillaro, Giada Zingarini, Ben Usman, Avneesh Sud, Davide Cozzolino, and Luisa Verdoliva. A bias-free training paradigm for more general ai-generated image detection. arXiv preprint arXiv:2412.1767 2024.
[15] Seoyeon Gye, Junwon Ko, Hyounguk Shon, Minchan Kwon, and Junmo Kim. Sfid: Reducing the content bias for ai-generated image detection. arXiv preprint 27X1v22502.17105, 2025.

---

[16] Jian Han, Jinlai Liu, Yi Jiang, Bin Yan, Yuqi Zhang, Zehuan Yuan, Bingyue Peng, and Xiaobing Liu. Infinity: Scaling bitwise autoregressive modeling for high-resolution image synthesis. arXiv preprini arXiv:2412.04431, 2024.
[17] Xinan He, Yue Zhou, Bing Fan, Bin Li, Guopu Zhu, and Feng Ding. Viforgery face triad: Detection, localization and attribution via multimodal large language models. arXiv preprini arXiv:2503.06142 142, 2025.
[18] Jonathan Ho et al. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:6840-688 10000 2020.
[19] Dimitrios Karageorgiou, Symeon Papadopoulos, Ioannis Kompatsiaris, and Efstratios Gavves. Any-resolttion ai- g-ggnnrrated image detection by spectral learning. In CVPR, 2025.
[20] Tero Karras al. Progressive growing of gans for improved quality, stability, and variation. In International Conference on Learning Representations, 2018.
[21] Tero Karras et al. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4401-4410, 2019.
[22] Black Forest Labs. Flux. http::://gttbb..mmmm///
forest Latiitllabbbf/lful 2024.
[23] Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang. Yao Hu, and Fuli Feng. Improving synthetic image detection towards generalization: An image transformation perspective. arXiv preprint 2rXiv:2408..66744 067411 2024.
[24] Ziqiang Li. Jiazhen Yan, Ziwen He. Kai Zeng, Weiwei Jiang, Lizhi Xiong, and Zhangjic Fu. Is artificial intelligence generated image detection solved problem? arXiv preprint a505::2505. /233,, 2025.
(25) Kaiqing Lin, Yuzhen Lin, Weixiang Li, Taiping Yao, and Bin Li. Standing the shoulders of giants: Reprogramming visual- lingaa-language model for general deepfake detection. In Proceedings of the AAAI Conference Artificial Intelligence, volume 39, pages 5262-5270, 2025.
[26] Kaiqing Lin, Zhiyuan Yan, Ruoxin Chen, Junyan Ye, YueYue Zhang, Yue Zhou, Peng Jin, Bin Li, Taiping Yao, and Shouhong Ding. Seeing before reasoning: A unified framework for generalizable and explainable fake image detection. arXiv preprint arXiv:2509.25500 2025.
[27] Kaiqing Lin, Zhiyuan Yan, Ke- Yue Zhang, Li Hao, Yue Zhou, Yuzhen Lin, Weixiang Li, Taiping Yao, Shouhong Ding, and Bin Li. Guard me if you know me: Protecting specific face-identity from deepfakes. arXiv preprint arXiv:2505. 19582, 2025.
[28] Tsung- Yi Lin et al. Microsoft coco: Common objects in context. In European Conference Computer Vision, pages 740-755. Springer, 2014.
[29] Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer vision-ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part 13, pages 740-755. Springer, 2014.
[30] Honggu Liu et al. Spatial-phase shallow learning: rethinking face forgery detection in fre- quency domain. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 772-781, 2021.
[31] Huan Liu, Zichang Tan, Chuangchuang Tan, Yunchao Wei, Jingdong Wang, and Yao Zhao Forgery-awarr adaptive transformer for generalizable synthetic image detection. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 10770-10780, 2024.
[32] Utkarsh Ojha et al. Towards universal fake image detectors that generalize across genera- tive models. Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 24489-24489, 2023.
12

---

[33] Anirudh Sundara Rajan, Utkarsh Ojha, Jedidiah Schloesser. and Yong Jae Lee. Aligned datasets improve detection of latent diffusion -enerrated images, 2025.
[34] Robin Rombach et al. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 10684-10695, 2022.
[35] Zeyang Sha, Zheng Li, Ning Yu, and Yang Zhang. De-fake: Detection and attribution of fake images generated by text-to-image generation models. In Proceedings of the 2023 ACM SIGSAC conference on computer and communications security, pages
2023.
[36] Yiren Song, Shengtao Lou, Xiaokang Liu, Hai Ci, Pei Yang, Jiaming Liu, and Mike Zheng Shou. Anti-reference: Universal and immediate defense against reference-based generation. arXiv preprint arXiv:24/2.05900 2024.
[37] Chuangchuang Tan et al. Learning on gradients: Generalized artifacts representation for gan- generated images detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 12105-12114, June 2023.
[38] Chuangchuang Tan, Renshuai Tao, Huan Liu, Guanghua Gu, Baoyuan Wu, Yao Zhao, and Yunchao Wei. C2p-clip: Injecting category common prompt in clip to enhance generalization in deepfake detection. In Proceedings of the AAAI Conference on Artificial Intelligence, 2024.
[39] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Frequency-aware deepfake detection: Improving generalizability through frequency space domain learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 5052-5060, 2024.
[40] Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethink- ing the up up-sampling operations in enn-based generative network for generalizable deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 281 1813028139, 2024.
[41] Aäron Van Den Oord, Nal Kalchbrenner, and Koray Kavukcuoglu. Pixel recurrent neural networks. In International conference on machine learning, pages 1747-1756. PMLR, 2016.
[42] Sheng-Yu Yu Wang et al. Cnn-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8695 8704, 2020.
[43] SY Wang et al. Con-generated images are surprisingly easy to spot... for now. In Proceedings of the JEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020.
[44] Shitao Xiao, Yueze Wang, Junjie Zhou, Huaying Yuan, Xingrun Xing, Ruiran Yan, Chaofan Li, Shuting Wang, Tiejun Huang, and Zheng Liu. Omnigen: Unified image generation. arXiv preprint arXiv:2409. 11340, 2024.
[45] Zhipei Xu, Xuanyu Zhang, Runyi Li, Zecheng Tang, Qing Huang, and Jian Zhang. Fakeshield: Explainable image forgery detection and localization via multi-modal large language models. In The Thirteenth International Conference on Learning Representations, 2025.
[46] Zhipei Xu, Xuanyu Zhang, Xing Zhou, and Jian Zhang. Avatarshield: Visual reinforcement learning for human-centric video forgery detection. arXiv preprint 15Xiv:2505.15173. 2025.
[47] Jiazhen Yan, Fan Wang, Weiwei Jiang, Ziqiang Li, and Zhangjie Fu. Ns-net: Decoupling clip semantic information through null-space for generalizable ai-generated image detection. arXiv preprint arXiv:2508. 01248, 2025.
[48] Shilin Yan, Ouxiang Li, Jiayin Cai, Yanbin Hao, Xiaolong Jiang, Yao Hu, and Weidi Xie. A sanity check for ai-generated image detection. arXiv preprint arXiv:2406. 2024.
[49] Zhiyuan Yan, Kaiqing Lin, Zongjian Li, Junyan Ye, Hui Han, Zhendong Wang, Hao Liu, Bin Lin, Hao Li, Xue Xu, et al. Can understanding and generation truly benefit together-or just 2025.
coexist? arXiv preprint
13

---

[50] Zhiyuan Yan, Jiangming Wang, Peng Jin, Ke-Yue Zhang, Chengchun Liu, Shen Chen, Taiping Yao, Shouhong Ding, Baoyuan Wu, and Yuan. Orthogonal subspace decomposition for generalizable ai-generated image detection. In Forty-second International Conference on Machine Learning.
[51] Zhiyuan Yan, Taiping Yao, Shen Chen, Yandan Zhao, Xinghe Fu, Junwei Zhu, Donghao Luo, Chengjie Wang, Shouhong Ding, Yunsheng Wu, et al. Df40: Toward next-generation deepfake detection. arXiv preprint arXiv:2406.13433 2024.
[52] Zhiyuan Yan, Junyan Ye, Weijia Li, Zilong Huang, Shenghai Yuan, Xiangyang He, Kaiqing Lin, Jun He, Conghui He, and Li Yuan. Gpt-imgeval: A comprehensive benchmark for diagnosing gpt4o in image generation. arXiv preprint arxiv:2504.027770 2025.
[53] Xiao Yu, Kejiang Chen, Kai Zeng, Han Fang, Zijin Yang. Xiuwei Shang, Yuang Qi, Weiming Zhang, and Nenghai Yu. Semgir: Semantic-guidee image regeneration based method for ai-g ui-generated image detection and attribution. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 8480-8488, 2024.
[54] Yabo Zhang, Yuxiang Wei, Dongsheng Jiang, Xiaopeng Zhang, Wangmeng Zuo, and Qi Tian. Controlvideo: Training-free controllable texl-to-video generation. arXiv preprint arXiv:2335.13377, 2023.
[55] Chende Zheng, Chenhao Lin, Zhengyu Zhao, Hang Wang, Xu Guo, Shuai Liu, and Chao Shen. Breaking semantic artifacts for generalized ai-generated image detection. Advances in Neural Information Processing Systems, 37:59570-59596, 2024.
[56] Nan Zhong, Yiran Xu, Sheng Li, Zhenxing Qian, and Xinpeng Zhang, Patchcraft: Exploring texture patch for efficient ai ai-generated image detection, arXiv preprint arXiv:2311.12397, pages
1-18, 2024.
[57] Yue Zhou, Bing Fan, Pradeep K. Atrey, and Feng Ding. Exposing deepfakes using network with multi-axis attention and frequency analysis. In Proceedings of the 2023 ACM Workshop Information Hiding and Multimedia Security, pages 169-174, 2023.
[58] Yue Zhou, Xinan He, KaiQing Lin, Bin Fan, Feng Ding, and Bin Li. Breaking latent prior bias in detectors for generalizable aige image detection. arXiv preprint vrXiv:2506.0087/ 2025.
[59] Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang. Genimage: million-scale benchmark for detecting ai ui-generated image. Advances in Neural Information Processing Systems, 36:77771-77782. 2023.
14

---

The Appendix provides additional technical and evaluative details of our work. Section presents the implementation details of DDA. Section summarizes the peer methods. Section visualizes the degree of data alignment of different methods in the feature space. Section [ presents ablation studies on input size and backbone. Section E provides details of our proposed dataset EvalGEN, including example prompts used for generation and visualizations of selected samples. Finally, Section visualizes the regional detection results of DDA.
A Implementation Details
Training Details. experiments were conducted on eight NVIDIA V100 GPUs. We trained the detector on dataset consisting of MSCOCO images and their synthetic counterparts generated through DDA alignment using the VAE from Stable Diffusion 2.1. The model was optimized with a base batch size of 16 and a learning rate of le-4. To achieve an effective batch size of 64 without exceeding GPU memory limits, gradient accumulation was applied over four iterations. Balanced accuracy was evaluated on all datasets every 10,000 iterations, and early stopping was employed to prevent overfitting To help the model better shape its decision boundary, each batch was manually constructed to include both real images and their DDA DDA-aligned counterparts, allowing the model to simultaneously observe closely aligned positive and negative samples.
B
Peer Methods
Below we provide brief description of the compared methods used in Section of main paper.
NPR 8 This detector leverages low-level features-neighheeee neighboring pixel relationships to distinguish synthetic images from real ones. NPR trains a ResNet-50 to identify upsampling patterns.
Instead of conventional supervised training, this method utilizes features from vision-language model (CLIP-ViT) combined with a linear classifier. This approach avoids overfitting specific generative artifacts and generalizes better unseen generators.
UnivFD 32
FatFormer builds on ViT backbone, incorporating a forgery-awan aware adapter that adapts features in both the image and frequency domains. It introduces sagguage-guidee alignment using contrastive learning with text prompts to improve generalization.
FatFormer [31
SAFE (23]
This method focuses on frequency domain artifacts. The detector built upon ResNet backbone and trained with several data augmentation techniques, including random masking.
The method utilizes CLIP embeddings with category-specift prompts to enhance deepfake detection generalizability. Image captions are generated using ClipCap and enhanced with category common prompts. During training, these enhanced caption-image pairs train the image encoder through contrastive learning. For inference, only the modified image encoder and linear classifier used.
C2P-CLIP 38
This work employs hybrid approach that combines low-level patch statisties with high-level semantics. It uses DCT scoring to select extreme frequency patches for extracting noise patterns through SRM filters, while utilizing CLIP embeddings to capture semantic information. These complementary features are fused through channel-wiss concatenation before classification.
AIDE 48
This method reconstructs real images using diffusion models to generate challenging synthetic samples that retain visual content while introducing subtle artifacts. Contrastive learning employed to guide detectors toward recognizing these fingerprints, improving generalization.
DRCT
This method creates aligned datasets by reconstructing real images through a single forward pass an LDM's autoencoder. This forces the detector to focus exclusively on artifacts introduced by the VAE decoder, avoiding reliance spurious correlations.
AliinedForensics 33
15

---

Real
Txtzimage
Diffusion Rec.
VAE Rec.
DDA
UnivFD
Better Alignment
DRCT
Aligned Forensics
DDA (ours)
FT-MSE
FT-EMA
SDXL
SD21
Figure 11: t-SNE visualizations comparing real and synthetic images using detectors trained with different data alignment methods. Rows correspond to the data alignment method used during detector training, while columns represent the generative pipeline- either VAE or diffusion-usee to produce synthetic images. The results show that detectors trained with better dataset alignment are able to separate reconstructed images more distinctly, highlighting the importance of effective dataset alignment in achieving clearer feature space separation.
B-Free introduces training paradigm using self-conditioned diffusion-based recon- structions. It ensures semantic alignment between real and synthetic images so that differences arise solely from generation artifacts. The approach includes content augmentation via inpainting and fine-tunes a DINOv2+reg ViT using large crops to retain forensic signals.
B-Free [14]
C More Comparison Results
Comparison to Dataset Alignment Methods in Feature Domain Fig 11 presents t-SNE visualiza- tions of real and synthetic image features, generated by detectors trained with varying data alignment strategies. Each row, from top to bottom, represents detectors trained on datasets with progressively stronger aligmment. Detectors trained on better-aligned datasets yield more separable feature distributions, suggesting that enhanced alignment facilitates clearer decision boundaries be- tween real and synthetic content. These findings reinforce the role of data alignment in improving feature separability and overall AGI detector performance.
D More Ablation Results
Ablation on Input Size Table 12 presents an ablation study of our method across different input sizes, ranging from 224 to 504. Detectors achieve comparable accuracies across these input sizes.
Ablation on Backbone Table presents an ablation study comparing the performance of different backbone architectures. The ResNet backbone is excluded from this study due to training instability and failure to converge. The relatively poor performance of linear probing methods is attributed the limited representational capacity of a single linear layer. This observation aligns with the convergence issues observed with ResNet, suggesting that the universal artifacts in our training data are inherently more difficult to learn. In contrast, AlignedForensies 33 successfully employs a ResNet backbone. implying that the artifacts used in our training setup may be subtler or more complex than those captured in prior work. Another key finding is that DINO-LoRA outperforms CLIP-LoRA. This
16

---

Table 12: Ablation study across different imput sizes.
Input Size
GenImage
DRCT-2M
EvalGEN
Chameleon
SyuthWildx
Avg
224
94.9
96.7
97.2
71.9
80.3
88.2 11.5
252
95.3
96.7
94.1
72.0
84.0
88.4 10.5
280
95.7
96.2
95.4
70.1
84.6
88.4 11.3
392
92.9
96.5
95.7
71.8
89.6
89.3 + 10,2
448
93.4
97.2
89.5
65.7
89.9
87. + 12.4
504
93.0
93.0
95.8
73.2
86.2
88.2 = 9.1
336
91.7
98.1
96.3
82.4
90.9
91.9 6.1
Table 13: Ablation on backbones and training strategies. Linear Probing refers to training linear classifier on frozen backbone features. LoRA Finetune denotes fine-tuning the backbone using LoRA (rank=8).
Tran Stratey
Backhone
GenImage
DRCT-2M
EvalGEN
Chamelean
SynthWildx Wilds
Avg
CLIP VIT-B/16
86.4
84.2
92.3
54.7
53,9
74.3
18.5
CLIP VIT-B/32
83.8
97.3
63.2
54.5
75.9 + 17.1
I Linear
CLIP VIT-1/14
91.2
91.2
98.9
59.1
52.8
78.6
21,1
Probing
VIT-S/14
68.8
DINOv2 VIT-B/14
68.3
74.5
66.2
64.1
58.6
66.8 4.9
DINOV2 VIT-L/14
70.5
75.6
56.8
60.6
61.6
65.0 7.8
CLIP VIT-B/16
95.2
46.6
62.0
76.1
21.5
LoRA Finetune
CLIP VIT-B/12
93.2
80.6
98.5
55.0
59.0
77.3
19.7
CLIP VIF-1/14
97.0
80.4
99.2
67.7
71.8
14.4
DINOv2 VIT-L/14
91.7
98.1
96.3
82.4
90.9
91.9 6.1
performance difference is likely due the architectural focus of each backbone: CLIP emphasizes high-level semantic features, while DINO is more attuned to low-level visual patterns patterns-which -which are more indicative of Al-generated image artifacts. Moreover, DINO-LoRA achieves a lower standard deviation, indicating greater stability for robust AGI detection.
Prompt 00 photo of backpack
Prompt 01 photo of backpack below a cake
Prompt 02 photo of backpack right of sandwich
Prompt 03 photo of banana
Prompt
photo of baseball bat
Prompt 05 photo of
baseball bat and a bear
Prompt 06 photo of
baseball bat and a fork
Prompt 07 photo of
bassball bat and giraffe
Prompt 08 photo of baseball glove
Prompt 09 photo of baseball glove and a carrot
Prompt 10 photo of baseball glove below an umbrella
Prompt 11 photo of baseball glove right of a bear
Prompt 12 photo of bear
Prompt
photo of bear above clock
Prompt 14 photo of bear above a speen
Prompt 15 photo of bed
Prompt 16
photo of bed right of frisbes
Prompt 17
photo of bed right of sports ball
Prompt 18
photo of a bench
Prompt 19
photo of a bench and snowboard
E More Details of EvaIGEN
To construct EvaIGEN, we used 553 distinct prompts, each generating 20 synthetic images per generator, resulting in 11 1,060 images per generator and total of 55,300 synthetic images in the complete dataset. All images are stored in JPEG format with a quality factor of 96. A subset of prompts is provided above to illustrate the dataset's diversity and semantic coverage, while
17

---

Fig. 12 shows visual examples from EvalGEN. To balance efficiency and representativeness, for the comparison in TableDann and Table of the main paper, we selected the first (index image generated for each prompt, yielding 55,300 20 = 2,765 samples for quantitative evaluation.
F Regional Detection Analysis
Figure 13 displays heatmaps of detection scores across segmented image regions, with numerical overlays indicating the detector's predictions. These results reveal that detection scores vary by region, indicating that synthetic artifacts are spatially uneven. This observation suggests that localized detection strategies could further enhance robustness.
18

---

Flux
GoT
Infintty
OmniClen
Figure 12: Examples from EvalGEN.
Synthbuster
Chameleon
ForenSynths
SynthWildx
AIGCDetoction
Benchmark
WildRF
EvaIGEN
Figure 13: Patch-level detection results. From top to bottom, images sourced from Synthbuster
Chameleon [48], ForenSynths [43), SynthWildx (7], AIGCDDeeecionnBeechnakk (56), WildRF 2 and EvalGEN (ours), respectively.
19

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Refer to Abstract and Section 1
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: Refer Section 5
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-texx system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess..
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
20

---

Justification:
Refer to Section 3.2
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: Refer Section
4
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
21

---

Answer: [Yes]
Justification: Refer to Abstract
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please the NeurlPS code and data submission guidelines (https://nips... cc/
pub ic gui Codeeubmme ssi aasionoolico for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//nips. cc/ wwwpiicggiiiipoooooo / /eddiddee//deeeeeeee Cooeeeooeeeeeeeeee SudeSuumiiee Submiss www.ssssiiigggooooo for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Refer to Section 4
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: Refer to Section 4
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
22

---

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of enrors is not verified.
For asymmetric distributions, the authors should be careful to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative eтror rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of exccution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Refer to Section 4
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http:////waas....oc//a//cc///c/t
Answer: [Yes]
Justification: Research conducted this paper conform with the NeurIPS Code of Ethics in every respect
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g.. if there is special consid- cration due to laws or regulations their jurisdiction..
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Refer to Section 5
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
23

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no risk for misuse
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: Refer to Section 4
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms of use the package should be provided. For popular datasets, papers thcode com dataaetteett has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Refer Supplementary
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdscourcing nor research with human subjects
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
25

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: Refer to Section
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs any important, original, non-standard components.
Please refer to our LLM policy (ht /et::///neeippppeee /et.urrppp.ccccooeeeeeree//////e 2025/ LLM) for what should or should not be described.
26


Reviews:
[{"review_id": "EQgMt78fvL", "reviewer": "Reviewer_xaYE", "summary": "This paper introduces Dual Data Alignment (DDA), a method to improve the generalizability of AI-generated image (AIGI) detectors by addressing dataset biases. Existing detectors struggle with new data because they often overfit on non-causal attributes like image format or size. DDA aligns synthetic and real images in both pixel and frequency domains, a crucial improvement over pixel-level alignment alone, which still leaves frequency-level discrepancies. The method involves VAE reconstruction, high-frequency fusion, and pixel mixup. DDA demonstrates significant performance improvements across diverse benchmarks, including new datasets like DDA-COCO and EvalGEN, highlighting its ability to create more unbiased and robust AIGI detectors", "questions": "1. Clarify and Substantiate the \"Universal Upsampling Artifact\" Claim.\nQuestion: The paper states: \"We hypothesize that this artifact arises during the VAE-based decoding process\". While interesting, this remains a hypothesis. What specific characteristics define this \"universal upsampling artifact\"? Can the authors provide more empirical evidence or theoretical reasoning to support its \"universality\" across diverse generative models beyond the VAE decoding stage?\n\n2. Address Performance on Heavily Post-Processed Images (Chameleon Dataset).\nQuestion: The paper acknowledges that \"Our method performs relatively lower on FLUX... and struggles to detect images with strong post-processing artifacts, as shown in the results on the Chameleon dataset\". Given that real-world scenarios often involve aggressive post-processing, how do the authors envision mitigating this limitation? Is DDA inherently sensitive to certain types of artifacts, or are there planned extensions to improve robustness in these challenging cases?\n\n3. Re-evaluate \"Theory Assumptions and Proofs\" Claim for Clarity.\nQuestion: The NeurIPS checklist response states \"Yes\" for \"For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?\" with a justification referring to Section 3.2. However, Section 3.2 primarily describes the methodology and provides intuitive explanations, rather than formal theoretical results, theorems, or proofs. This might be a misunderstanding of what constitutes a \"theoretical result\" in this context.", "limitations": "Yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 4, "originality": 4, "strengths_and_weaknesses": "Strengths: \nQuality based on robust experimental validation - The paper presents extensive evaluations across eight diverse datasets, including \"in-the-wild\" benchmarks, which significantly strengthens its claims of improved generalizability. The consistent outperformance of DDA over state-of-the-art methods (e.g., +12.4% on GenImage, +9.8% on Synthbuster, +17.7% on EvalGEN) is a strong indicator of its effectiveness. The inclusion of new, challenging test sets like DDA-COCO and EvalGEN is particularly valuable for rigorously assessing detector performance against new generative architectures and aligned data. The robustness analysis under various post-processing methods (JPEG compression, resizing, blurring) further validates DDA's practical utility, showing its ability to maintain high performance even when images are altered. This is critical for real-world deployment where images are frequently compressed or modified. The paper tackles the fundamental issue of dataset bias in AIGI detection, a well-recognized challenge that hinders the real-world applicability of detectors. By identifying and addressing both pixel-level and, crucially, frequency-level misalignment, the authors pinpoint a subtle yet significant source of bias that previous reconstruction methods missed.\n\nClarity - The paper clearly articulates the \"frequency-level misalignment\" problem with existing reconstruction methods, using Figure 3 and Figure 4 to visually and empirically demonstrate the issue. This strong motivation for DDA's dual-domain alignment is a major plus. The paper addresses very clear methodology, Figure 5 provides a clear visual pipeline of the proposed method.\n\nSignificance - The primary significance lies in the demonstrated improvement in generalizability for AIGI detectors. This is a crucial step towards more reliable and deployable fake image detection systems, addressing a pressing societal concern regarding misinformation and fraud.\n\nWeaknesses:\nQuality - The paper Limited Explanation of T freq and R pixel Parameter Selection and needs more information. \n\nClarity - \"Theory Assumptions and Proofs\" Claim: The paper states \"Yes\" for providing full assumptions and complete/correct proofs in Section 3.2. However, Section 3.2 primarily describes the methodology and motivation, not formal theorems, lemmas, or rigorous mathematical proofs in the traditional sense. This checklist answer might be misleading and could be interpreted as a claim of theoretical contribution that isn't fully supported by the content of Section 3.2.", "was_revised": true, "final_justification": "Accepted.", "rebuttal": "We sincerely thank you for your valuable time and comments. We are encouraged by your positive comments on the **significance** and **robust experimental validation** of our work! We will alleviate your remaining concerns as follows.\n\n---\n\n> *Q1: The paper Limited Explanation of $T_{freq}$ and $R_{pixel}$ Parameter Selection and needs more information.* \n \nThank you for the helpful suggestion. We clarify that \\$T\\_{\\text{freq}}\\$ and \\$R\\_{\\text{pixel}}\\$ control the degree of alignment in the frequency and pixel domains, respectively. Increasing their values enhances alignment strength, which can improve sensitivity to subtle generative artifacts. However, excessively strong alignment may shift the decision boundary too close to real images, potentially reducing true-positive accuracy. To balance this trade-off, we empirically set \\$T\\_{\\text{freq}} = 0.5\\$ and \\$R\\_{\\text{pixel}} = 0.8\\$, based on comprehensive validation in Figure 9 of the main paper.\n\n---\n\n> *Q2: Clarify and Substantiate the \"Universal Upsampling Artifact\" Claim. Question: The paper states: \"We hypothesize that this artifact arises during the VAE-based decoding process\". While interesting, this remains a hypothesis. What specific characteristics define this \"universal upsampling artifact\"? Can the authors provide more empirical evidence or theoretical reasoning to support its \"universality\" across diverse generative models beyond the VAE decoding stage?*\n \nThank you for this insightful question.\n\n**• What the universal artifact is:** We believe that the universal upsampling artifact stems from deterministic local correlations introduced by fixed, low-rank upsampling operations (e.g., bilinear interpolation, transposed convolution). These components, widely used in the decoders of VAEs, GANs, and diffusion models, project low-dimensional latents to high-resolution outputs. However, due to their limited representational capacity, they cannot fully capture the complexity of natural image statistics. As a result, generated images often exhibit reduced local rank and unnatural pixel dependencies—properties rarely seen in real images. These artifacts are therefore architectural in origin, rather than model-specific. Similar observations have been made in prior works such as NPR [1] and SPSL [2],\n\n**• Empirical evidence for university beyond the VAE decoding:** To substantiate universality, we highlight the results in Appendix Table 1. Our DDA detector, trained *only* on aligned VAE-reconstructed images, achieves SoTA on 9 out of 10 benchmarks. This strong generalization suggests that the universality is not confined to a specific generation mechanism.\n\n**Table 1: Comprehensive evaluation of DDA against state-of-the-art detectors on 10 benchmark datasets totaling 561k images generated by 12 GANs, 52 diffusion models, and 2 autoregressive models, including 3 in-the-wild datasets.** Generator types are indicated in parentheses (G = GAN, D = Diffusion, AR = Auto-Regressive). All detectors are evaluated using official checkpoints. To mitigate format bias, JPEG compression (quality 96) is applied to GenImage, ForenSynth, and AIGCDetectionBenchmark. \"DDA (ours) + JPEG Aug\" denotes training with additional random JPEG compression augmentation.\n\n| Method                    | GenImage | DRCT-2M  | DDA-COCO | EvalGEN  | Synthbuster | ForenSynth | AIGCDetection  Benchmark | Chameleon | Synthwildx | WildRF | Avg     | Min    |\n| --------------------------|----------|----------|----------|----------|-------------|------------|--------------|-----------|----------|----------|----------------|--------|\n|                           | 1G + 7D  | 16D      | 6D       | 5D + 2AR | 9D          | 11G        | 7G + 9D      | Unknown   | 3D       | Unknown  |                |        |\n| NPR (CVPR'24)             | 51.5     | 37.3     | 28.1     | 59.2     | 50.0        | 47.9       | 53.1         | 59.9      | 49.8     | 63.5     | 50.0 ± 10.7    | 28.1   |\n| UnivFD (CVPR'23)          | 64.1     | 61.8     | 3.6      | 15.4     | 67.8        | 77.7       | 72.5         | 50.7      | 52.3     | 55.3     | 52.1 ± 24.2    | 3.6    |\n| FatFormer (CVPR'24)       | 62.8     | 52.2     | 3.3      | 45.6     | 56.1        | *90.1*     | 85.0         | 51.2      | 52.1     | 58.9     | 55.7 ± 23.6    | 3.3    |\n| SAFE (KDD'25)             | 50.3     | 59.3     | 0.5      | 1.1      | 46.5        | 49.7       | 50.3         | 59.2      | 49.1     | 57.2     | 42.3 ± 22.3    | 0.5    |\n| C2P-CLIP (AAAI'25)        | 74.4     | 59.2     | 2.0      | 38.9     | 68.5        | **92.1**  | 81.4          | 51.1      | 57.1     | 59.6     | 58.4 ± 25.0    | 2.0    |\n| AIDE (ICLR'25)            | 61.2     | 64.6     | 1.2      | 15.0     | 53.9        | 59.4       | 63.6         | 63.1      | 48.8     | 58.4     | 48.9 ± 22.3    | 1.2    |\n| DRCT (ICML'24)            | 84.7     | 90.5     | 30.4     | 77.7     | 84.8        | 73.9       | 81.4         | 56.6      | 55.1     | 50.6     | 68.6 ± 19.4    | 30.4   |\n| AlignedForensics (ICLR'25)| 79.0     | 95.5     | 86.6     | 77.0     | 77.4        | 53.9       | 66.6         | 71.0      | 78.8     | 80.1     | 76.6 ± 11.2    | 53.9   |\n| **DDA (ours)**           | **95.5** | *97.4*   | **94.3** | *94.0*   | **94.6**   | 85.5       | **93.3**     | *74.3*    | *84.0*   | **95.1** | *90.8 ± 7.3*   | *74.3* |\n| **DDA (ours) + JPEG Aug**| *94.3*   | **97.9**| *92.8*    |**98.3** | *88.8*      | 83.2       | *89.6*       | **81.7**  | **88.0** | *94.9*   | **91.0 ± 5.7**|**81.7**|\n\n---\n\n> *Q3: Address Performance on Heavily Post-Processed Images (Chameleon Dataset). Question: The paper acknowledges that \"Our method performs relatively lower on FLUX... and struggles to detect images with strong post-processing artifacts, as shown in the results on the Chameleon dataset\". Given that real-world scenarios often involve aggressive post-processing, how do the authors envision mitigating this limitation? Is DDA inherently sensitive to certain types of artifacts, or are there planned extensions to improve robustness in these challenging cases?*\n\nThank you for highlighting this important concern. We address this limitation through two directions: (1) enhancing DDA's robsutness to heavily post-processing, and (2) integration DDA with vision-language models (VLMs) to incorporate semantic-level signals.\n\n**(1) Enhance DDA's robustness:** While DDA’s performance declines on challenging datasets like Chameleon, it still **outperforms all existing methods**. Moreover, as shown in the Table 1 (referenced in our response to Q2), applying stronger data augmentations (e.g., random JPEG compression) could effectively improve robustness, enabling DDA to further achieve **81% balanced accuracy on Chameleon**. To our knowledge, this marks the **first detector to exceed 80% accuracy**.\n\n**(2) Integration with VLM:** To further enhance resilience to aggressive edits, we plan to incorporate **semantic-level cues** that persist through low-level corruption—such as implausible object configurations (e.g., “a person with three hands”) or physically impossible scenes. These high-level inconsistencies complement DDA’s pixel- and frequency-level modeling. In preliminary experiments, prompting **Qwen2.5-VL-32B** as *“RealismNet, a multimodal expert who determines whether an image could be photographed in the real world without digital manipulation”* allowed the model to consistently flag semantically implausible content, suggesting strong potential as a complementary detection signal.\n\nOur future work will explore a **hybrid detection framework**, where a vision-language model helps localize reliable regions in the image that are less affected by post-processing. DDA can then focus on those regions to detect subtle generation artifacts. This synergy between **semantic robustness and low-level generalization** offers a promising path toward robust, real-world AI-generated image detection.\n\n---\n\n> *Q4: \"Re-evaluate \"Theory Assumptions and Proofs\" Claim for Clarity.*\n\nThank you for pointing this out. We acknowledge the misunderstanding regarding the checklist item on \"Theory Assumptions and Proofs.\" Section 3.2 provides methodological intuition rather than formal theorems or proofs. We will revise our response to “\\[N/A]” to more accurately reflect the content of the paper.\n\n---\n\n[1] Rethinking the Up-Sampling Operations in CNN-based Generative Network for Generalizable Deepfake Detection, CVPR 2024.\n\n[2] Spatial-Phase Shallow Learning: Rethinking Face Forgery Detection in Frequency Domain, CVPR 2021."}, {"review_id": "5gj5yn5Una", "reviewer": "Reviewer_sHpt", "summary": "This study identifies that single reconstruction alone does not suffice to achieve comprehensive alignment between real and synthetic image pairs. To address this limitation, the authors propose a novel approach termed Dual Data Alignment (DDA), which aligns synthetic images with their real counterparts in both pixel and frequency domains, thereby reducing bias in AIGI detectors. Furthermore, two new AIGI datasets are presented to expand testing scenarios across diverse domains. Extensive evaluations conducted on eight benchmark datasets validate the effectiveness of the proposed methodology.", "questions": "1. Please refer to weakness.\n2. The authors should clarify the fairness of the experimental comparisons. Specifically, in Table 3, it is unclear whether the proposed method and the baseline methods were trained on the same datasets and under comparable settings. This information is critical for a fair evaluation.\n3. The backbone used in the proposed method is DINOv2, while some baselines adopt different backbones such as CLIP or ResNet. The authors should discuss how the choice of backbone influences performance and whether it contributes significantly to the observed improvements.", "limitations": "The paper should provide a more comprehensive discussion on the motivations behind image reconstruction as well as address issues related to experimental fairness, ensuring greater transparency and equity in the evaluation process.", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The writing of this manuscript is generally clear and easy to follow.\n2. The topic of detecting AIGC (AI-Generated Content) images is both timely and interesting.\n3. The authors have conducted extensive experiments, which demonstrate the effectiveness and relevance of the proposed method.\n4. The proposed method is novel in that it simultaneously considers both pixel-level and frequency-domain alignment.\n\nWeaknesses：\n1. The authors claim that existing datasets suffer from biases in format, content, and size. However, these biases can often be mitigated through data augmentation or by expanding the dataset, without the need for complex reconstruction-based approaches. For instance, JPEG compression and cropping augmentation could address format and size biases effectively.\n2. The primary objective of reconstruction-based methods is typically to uncover the intrinsic differences between real and fake images, rather than to align real and fake data distributions.\n3. It is unclear whether the proposed method and the baselines in Table 3/4/5/6 were trained under the same conditions, particularly with respect to the training dataset. Clarification on this point would be helpful for a fair comparison.\n4. Since the proposed method uses DINOv2 as the backbone, whereas some baselines rely on CLIP or ResNet, it would be important to discuss how the choice of backbone affects the results. This would help ensure a fair and meaningful comparison.\n5. The proposed method has not been evaluated on the ForenSynths dataset (CNNSpot CVPR 2020), a commonly used benchmark for detecting CNN-generated images. This limits the completeness of the experimental validation.\n6. The generalization capability of the proposed DDA method to GAN-generated images is not discussed. It would be beneficial to evaluate its performance on such images to better understand its applicability across different types of generative models.", "was_revised": true, "final_justification": "I would like to thank the authors for their rebuttal.\nIn their response, some of my doubts were addressed. However, I still have concerns about fair comparisons. The authors claim to have used the official checkpoints of the baselines, but different training data were used for different baselines in the table, which makes the comparison unfair. Overall, the dataset proposed by the authors is interesting, but the experimental comparisons are concerning. I keep my score.", "rebuttal": "We appreciate your positive comments on our **novelty, extensive experiments** and **writing**! We will alleviate your remaining concerns.\n\n---\n\n> *Q1: The biases in format, content, and size can be mitigated through data augmentation or by expanding the dataset, without the need for reconstruction.* \n\nThank you for raising this important concern.\n\n**Content and size bias:** reconstruction-based methods able to generate aligned synthetic counterparts, preserving content while altering only generation-specific characteristics. in contrast, dataset expansion cannot guarantee precise semantic alignment in every detail (e.g., object types, textures, and layouts), leaving content bias unaddressed.\n\n**On the complexity of reconstruction-based approaches:** We respectfully disagree that reconstruction-based methods are overly complex. With modern frameworks (e.g., *diffusers*), VAE reconstruction is accessible and computationally lightweight. Table 10 of our main paper shows DDA is more efficient than many existing baselines in terms of generation time.\n\n**Format bias:** Due to the asymmetric encoding in real vs. synthetic training images (JPEG-compressed real vs. PNG synthetic), JPEG augmentation can result in **double-compressed real images** versus **single-compressed synthetic images**. Consequently, models may learn to associate stronger compression artifacts with authenticity. We empirically substantiate this in Tables 1 and 2:\n\n* **Table 1** shows that VAE reconstruction + JPEG augmentation exhibits **a significant drop (↓22.0)** when tested on JPEG-format synthetic images, indicating format bias. In contrast, DDA maintains stable performance (↑3.0).\n\n* **Table 2** evaluates the frequency-based detector SAFE. Even with JPEG augmentation, SAFE suffers a **a significant drop (↓21.0)** in accuracy on JPEG-format images. This highlights that augmentation-only methods fail to completely eliminate format bias.\n\n**Table 1. Evaluation of JPEG compression augmentation for mitigating format bias.** VAE reconstruction with JPEG compression augmentation (VAE Rec. + JPEG Aug) versus VAE reconstruction with our proposed Dual Data Alignment (VAE Rec. + DDA). We report accuracies on detecting PNG-format and JPEG-format synthetic images on GenImage.\n\n| Method            | Format | Midjourney |SD14| SD15| ADM  | GLIDE|Wukong| VQDM |BigGAN| AVG ± STD           |\n|-------------------|--------|-------|--------|------|------|------|------|------|------|---------------------|\n| VAE Rec. + JPEG Aug | PNG  |  86.5 |  100.0 | 99.8 | 86.0 | 86.5 | 99.9 | 91.3 | 68.9 | 89.9 ± 10.6         |\n| VAE Rec. + JPEG Aug | JPG  |  92.2 |   98.9 | 98.9 | 45.2 | 67.3 | 99.2 | 40.2 | 1.3  | 67.9 ± 36.3 (↓22.0) |\n| VAE Rec. + DDA      | PNG  |  93.5 |   99.7 | 99.5 | 86.0 | 84.2 | 99.5 | 89.5 | 93.6 | 93.2 ± 6.2          |\n| VAE Rec. + DDA      | JPG  |  94.3 |   99.9 | 99.6 | 93.6 | 91.0 | 99.7 | 94.1 | 97.1 | 96.2 ± 3.4 (↑3.0)   |\n\n\n**Table 2. Evaluation of format bias mitigation for SAFE.** \n\n| Method          | Format| Midjourney | SD14 | SD15 | ADM  | GLIDE | Wukong | VQDM | BigGAN | AVG ± STD           |\n|-----------------|-------|------------|------|------|------|-------|--------|------|--------|---------------------|\n| SAFE            | PNG   |       91.2 | 99.5 | 99.4 | 64.7 |  93.3 |   97.2 | 93.3 |   96.6 | 91.9 ± 11.4         |\n| SAFE            | JPG   |        0.5 |  1.7 | 2.0  |  1.5 |   8.2 |  3.0   |  2.7 |    4.6 | 3.0 ± 2.4 (↓88.9)   |\n| SAFE + JPEG Aug | PNG   |       90.3 | 96.8 | 96.3 | 62.2 |  91.9 |   89.7 | 73.1 |   89.2 | 86.2 ± 12.1         |\n| SAFE + JPEG Aug | JPG   |       60.7 | 61.5 | 61.0 | 80.6 |  83.1 |   63.3 | 76.2 |   35.1 | 65.2 ± 15.3 (↓21.0) |\n\n---\n\n> *Q2: Unclear whether the proposed method and the baselines in Table 3/4/5/6 were trained under the same conditions.*\n\nThank you for raising this important concern.\n\n**Clarification on training conditions:** We respectfully clarify that for the comparisons in Tables 3–6, we follow established practices by using the **official checkpoints released by the original authors** for all baseline methods. This evaluation protocol is also adopted in prior work such as AIDE, and DRCT.\n\n* **Fair comparison:** We acknowledge that DDA may benefit from certain training setups in Table 3. To provide a more comprehensive and balanced view, we include an extended evaluation in **Appendix Table 1** (see following Table 3). **DDA achieves SoTA on 9 out of 10 datasets.**\n\n* **One-to-one comparisons:** In Table 4 we conduct additional experiments where all training variables are held constant, and the only change is substituting the synthetic training data with **DDA-aligned counterparts**. These controlled results consistently show that **DDA significantly enhances generalization performance**, isolating the impact of our alignment strategy.\n\n**Table 3: Comprehensive evaluation of DDA against state-of-the-art detectors on 10 benchmark datasets comprising 561k images from 12 GANs, 52 diffusion models, and 2 autoregressive models, including 3 in-the-wild datasets.**\n\n| Method                     | GenImage | DRCT-2M  | DDA-COCO | EvalGEN  | Synthbuster | ForenSynth | AIGCDetection  Benchmark | Chameleon | Synthwildx | WildRF   | Avg            | Min      |\n| -------------------------- | -------- | -------- | -------- | -------- | ----------- |---------- | ----------------------- | --------- | ---------- | -------- | -------------- | -------- |\n| NPR (CVPR'24)              | 51.5     | 37.3     | 28.1     | 59.2     | 50.0    | 47.9    | 53.1     | 59.9      | 49.8       | 63.5     | 50.0 ± 10.7    | 28.1     |\n| UnivFD (CVPR'23)           | 64.1     | 61.8     | 3.6      | 15.4     | 67.8    | 77.7    | 72.5     | 50.7      | 52.3       | 55.3     | 52.1 ± 24.2    | 3.6      |\n| FatFormer (CVPR'24)        | 62.8     | 52.2     | 3.3      | 45.6     | 56.1    | *90.1*  | *85.0*   | 51.2      | 52.1       | 58.9     | 55.7 ± 23.6    | 3.3      |\n| SAFE (KDD'25)              | 50.3     | 59.3     | 0.5      | 1.1      | 46.5    | 49.7    | 50.3     | 59.2      | 49.1       | 57.2     | 42.3 ± 22.3    | 0.5      |\n| C2P-CLIP (AAAI'25)         | 74.4     | 59.2     | 2.0      | 38.9     | 68.5    |**92.1** | 81.4     | 51.1      | 57.1       | 59.6     | 58.4 ± 25.0    | 2.0      |\n| AIDE (ICLR'25)             | 61.2     | 64.6     | 1.2      | 15.0     | 53.9    | 59.4    | 63.6     | 63.1      | 48.8       | 58.4     | 48.9 ± 22.3    | 1.2      |\n| DRCT (ICML'24)             | *84.7*   | 90.5     | 30.4     | *77.7*   | *84.8*  | 73.9    | 81.4     | 56.6      | 55.1       | 50.6     | 68.6 ± 19.4    | 30.4     |\n| AlignedForensics (ICLR'25) | 79.0     | *95.5*   | *86.6*   | 77.0     | 77.4    | 53.9    | 66.6     | *71.0*    | *78.8*     | *80.1*   | *76.6* ± 11.2  | *53.9*   |\n| **DDA (ours)**            | **95.5** | **97.4**| **94.3** | **94.0** |**94.6**| 85.5     | **93.3**| **74.3**  | **84.0**   | **95.1** | **90.8** ± 7.3 | **74.3** |\n\n\n**Table 4. One-to-One comparisons.**\n\n| Method          | GenImage         | DRCT-2M          | DDA-COCO         | EvalGEN          | Chameleon        | WildRF          |  AVG             |\n|-----------------|------------------|------------------|------------------|------------------|------------------|-----------------|------------------|\n| UnivFD       |  64.1            | 61.8             | 51.4             | 15.4             | 50.7             | 55.3            | 49.8             |\n| UnivFD + DDA    |**92.4 (↑28.3)** | **76.1 (↑14.3)** | **78.2 (↑26.8)**| **98.7 (↑83.3)**| **65.6 (↑14.9)**| **56.6 (↑1.3)** |**77.9 (↑28.1)** |\n| Fatformer   |  62.8            | 52.2             | 49.9             | 45.6             | 51.2             | 58.9            | 53.4             |\n| Fatformer + DDA | **65.5 (↑2.7)** | **58.9 (↑6.7)**  | **68.6 (↑18.7)**| **77.0 (↑31.4)**| **54.0 (↑2.8)** | 51.3 (↓7.6)      | **62.6 (↑9.2)** |\n| DRCT        |  84.7            | 90.5             | 62.3             | 77.7             | 56.6             | 50.6            | 70.4             |\n| DRCT + DDA      | **91.7 (↑7.0)** | 86.2 (↓4.3)       |**77.3 (↑15.0)** | **97.2 (↑19.5)**| **68.0 (↑11.4)**| **54.8 (↑4.2)** | **79.2 (↑8.8)** |\n\n---\n\n> *Q3: The impact of backbone.*\n\nThank you for this question. We respectfully point out that **we have already conducted ablation studies on backbones in Appendix Table 7.** Below, we provide a simplified version of the results. While **DDA performs best with DINOv2**, it still **significantly outperforms all baseline methods when using CLIP**.\n\n**Table 5. Ablation study on backbone.**\n\n| Method    |Backbone             | GenImage | DRCT-2M |DDA-COCO| EvalGEN |Synthbuster|Chameleon |SynthWildx | Avg         |\n| --------- |---------------------|----------|---------|--------|---------|-----------|----------|-----------|-------------|\n| Fatformer |CLIP ViT-L/14        | 62.8      | 52.2   | 49.85   | 45.6    | 56.1     | 51.2     | 52.1      | 52.8 ± 5.4  |\n| UnivFD    |CLIP ViT-L/14        | 64.1     | 61.8    | 51.4   | 15.4    | 67.8      | 50.7     | 52.3      | 51.9 ± 17.5 |\n| DRCT      |CLIP ViT-L/14        | 84.7     | 90.5    | 62.3   | 77.7    | *84.8*    | 56.6     | 55.1      | 73.1 ± 14.8 |\n| C2P-CLIP  |CLIP ViT-L/14        | 74.4     | 59.2    | 49.9   | 38.9    | 68.5      | 51.1     | 57.1      | 57.0 ± 11.9 |\n| AIDE   |CLIP-ConvNeXt | 61.2| 64.6 | 50.0   | 15.0    | 53.9      | 63.1     | 48.8      | 50.9 ± 17.1 |\n| DDA       |CLIP ViT-L/14        | **97.0** | 80.4    |**98.8**|**99.2**| 68.3      | *67.7*   | *71.8*    |*83.3 ± 14.7*|\n| DDA       |DINOv2 VIT-L/14      | *95.5*   | **97.4**| 94.3   | 94.0    | **94.6** | **74.3** | **84.0**  |**90.6 ± 8.4**|\n\n---\n\n> *Q4: The proposed method has not been evaluated on ForenSynths.*\n\nThank you for raising this important concern. We respectfully clarify that **DDA has been already evaluated on ForenSynth in Appendix Table 3**."}, {"review_id": "f1CN1V2OmD", "reviewer": "Reviewer_ks8s", "summary": "This paper proposes a new method for AI-generated Image (AIGI) detection. The paper hypothesizes that dataset bias, both in pixel-level semantics and in frequency domain is an important factor for the insufficient generalizability of the existing detection methods to unseen generative models. Therefore, this paper, for the first time introduces a dual data alignment (DDA) pipeline to minimize the effect of dataset bias and create a real vs. AI-generated dataset from MS-COCO (referred to as DDA-COCO).  By fine-tuning a DINOv2 backbone using LoRA on DDA-COCO, the proposed method achieves state-of-the-art performance in terms of balanced accuracy on several existing benchmarks as well as two new benchmarks introduces in this paper.", "questions": "Referring to the weaknesses section I have the following questions:\n\n1. How would existing methods' performance change if DDA was used to minimize the training dataset bias?\n2. How AP or AUROC of the proposed method compare with that of the existing methods?\n3. How thresholds for different methods are chosen in this study?\n\nBased on the authors' response, I would be willing to increase my rating to 5 (accept).", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n1. The paper is well-written, and it is easy to follow. \n2. The frequent use of clear visualizations and figures helps with understanding the concepts and the proposed novelties.\n3. The proposed method is properly motivated and is an easy-to-understand and elegant solution.\n4. The proposed method shows robust performance across several datasets, achieving state-of-the-art results.\n5. The experimental results are extensive and the proposed method's performance is compared against recently published papers in top-tier venues on recent benchmarks.\n\n**Weaknesses**\n1. The main hypothesis of the paper (dataset bias is the problem and that the data alignment helps) is not verified in isolation. Although extensive experimental results show strong performance of the proposed method, the strong performance cannot be solely attributed to the use of the data alignment pipeline. There are several differences between the proposed method and existing approaches other than the use of DDA. For example, the original source of data used in this paper is different from those used in competitive methods. Additionally, the backbone, the fine-tuning strategy and the input size to the backbone are all different compared to existing methods. Given this, it is hard to be sure if DDA is the main reason behind the proposed method's strong performance.\n2. The paper does not report threshold-less metrics such as AP or AUROC which are commonly used in many published papers in this area. Threshold-less metrics are important measures of the separability between the representation of real vs AI-generated samples. Additionally, the difference in accuracy numbers can be attributed to the poor choice of the decision thresholds. \n3. The mechanism for choosing a decision threshold is not discussed in the paper.", "was_revised": true, "final_justification": "All of my concerns are addressed in the authors' rebuttal, and I feel more confident in accepting the paper. Therefore, I raise my initial rating to 5.", "rebuttal": "We are grateful for your positive recognition of our **novelty, extensive experiments** and **writing**! We will alleviate your remaining concerns.\n\n---\n\n> *Q1: The main hypothesis of the paper (dataset bias is the problem and that the data alignment helps) is not verified in isolation. Although extensive experimental results show strong performance of the proposed method, the strong performance cannot be solely attributed to the use of the data alignment pipeline. There are several differences between the proposed method and existing approaches other than the use of DDA. For example, the original source of data used in this paper is different from those used in competitive methods. How would existing methods' performance change if DDA was used to minimize the training dataset bias?*\n\nThank you for this thoughtful question. \n\nWe respectfully clarify that, in line with established evaluation practices, we use the **official checkpoints released by the original authors** for baseline methods—**a standard protocol also followed in prior works such as FatFormer, C2P-CLIP, AIDE, and DRCT**—ensuring consistency and fairness in comparison.\n\nTo directly address your concern, we conduct a **controlled one-to-one comparison**, where we adopt the **same architecture, training strategy, and real image source as the competitive method**, but **replace its synthetic images of its training set with DDA-aligned images**. This setup isolates the impact of DDA while keeping all other factors constant. Preliminary results show clear performance improvements.\n\n**Table 1. Controlled one-to-one comparison of existing methods with and without DDA-aligned training data.** Each baseline method (UnivFD, FatFormer, DRCT) is retrained under identical settings, replacing only the original synthetic training data with DDA-aligned samples. DDA consistently improves performance across all datasets.\n\n| Method          | GenImage         | DRCT-2M          | DDA-COCO         | EvalGEN          | Chameleon        | WildRF          |  AVG             |\n|-----------------|------------------|------------------|------------------|------------------|------------------|-----------------|------------------|\n| UnivFD       |  64.1            | 61.8              | 51.4            | 15.4             | 50.7             | 55.3            | 49.8             |\n| UnivFD + DDA |**92.4 (↑28.3)** | **76.1 (↑14.3)** | **78.2 (↑26.8)**| **98.7 (↑83.3)**| **65.6 (↑14.9)**| **56.6 (↑1.3)** |**77.9 (↑28.1)** |\n| Fatformer       |  62.8            | 52.2             | 49.9             | 45.6             | 51.2             | 58.9            | 53.4             |\n| Fatformer + DDA | **65.5 (↑2.7)** | **58.9 (↑6.7)**  | **68.6 (↑18.7)**| **77.0 (↑31.4)**| **54.0 (↑2.8)** | 51.3 (↓7.6)      | **62.6 (↑9.2)** |\n| DRCT        |  84.7            | 90.5             | 62.3             | 77.7             | 56.6             | 50.6            | 70.4             |\n| DRCT + DDA  | **91.7 (↑7.0)** | 86.2 (↓4.3)       |**77.3 (↑15.0)** | **97.2 (↑19.5)**| **68.0 (↑11.4)**| **54.8 (↑4.2)** | **79.2 (↑8.8)** |\n\n\n> *Q2: The paper does not report threshold-less metrics such as AP or AUROC which are commonly used in many published papers in this area. Threshold-less metrics are important measures of the separability between the representation of real vs AI-generated samples.*\n\nThank you for this thoughtful suggestion regarding threshold-independent evaluation metrics. We clarify that, in line with prior works such as C2P-CLIP, DRCT, AlignedForensics, and AIDE, our main paper reports balanced accuracy for comparability. Following your suggestion, we have additionally computed **AP and AUROC scores** for our method. Our method **DDA achieves state-of-the-art performance**, with average scores of **0.964(AP)** and **0.967(AUROC)**—outperforming all baselines by a non-trivial margin. These results confirm the superior performance of DDA.\n\n**Table 2. Overall Comparison of AP / AUROC.** Bold numbers indicate the best score per row; values in parentheses denote the absolute improvement over the original method.\n\n| Method | DRCT-2M | GenImage | Synthbuster | SynthWildx | WildRF | AIGCDetection  Benchmark | ForenSynth | Chameleon | AVG | MIN |\n|--------|----------|----------|----------|----------|----------|----------|----------|----------|----------|----------|\n| NPR (CVPR'24) | 0.403/0.271 | 0.501/0.440 | 0.509/0.515 | 0.529/0.533 | 0.742/0.702 | 0.464/0.372 | 0.450/0.338 | 0.517/0.551 | 0.514/0.465 | 0.403/0.271 |\n| UnivFD (CVPR'23) | 0.857/0.864 | 0.825/0.838 | 0.792/0.797 | 0.521/0.463 | 0.624/0.541 | 0.868/0.879 | 0.918/0.921 | 0.477/0.554 | 0.735/0.732 | 0.477/0.463 |\n| FatFormer (CVPR'24) | 0.478/0.386 | 0.715/0.684 | 0.580/0.560 | 0.572/0.584 | 0.759/0.707 | 0.920/0.907 | *0.981/0.975* | 0.614/0.608 | 0.702/0.676 | 0.478/0.386 |\n| SAFE (KDD'25) | 0.577/0.554 | 0.539/0.554 | 0.542/0.527 | 0.496/0.491 | 0.707/0.621 | 0.520/0.524 | 0.542/0.545 | 0.506/0.571 | 0.554/0.548 | 0.496/0.491 |\n| C2P-CLIP (AAAI'25) | 0.707/0.652 | 0.923/0.909 | 0.876/0.859 | 0.671/0.685 | 0.751/0.727 | *0.933/0.921* | **0.982/0.978** | 0.464/0.442 | 0.788/0.772 | 0.464/0.442 |\n| AIDE (ICLR'25) | 0.702/0.705 | 0.755/0.767 | 0.499/0.448 | 0.466/0.438 | 0.714/0.647 | 0.792/0.806 | 0.768/0.740 | 0.430/0.454 | 0.641/0.626 | 0.430/0.438 |\n| DRCT (ICML'24) | *0.961/0.965* | *0.939/0.949* | *0.901/0.903* | 0.576/0.598 | 0.595/0.534 | 0.907/0.917 | 0.890/0.898 | 0.663/0.719 | 0.804/0.810 | 0.576/0.534 |\n| AlignedForensics (ICLR'25) | 0.998/0.998 | 0.930/0.947 | 0.796/0.805 | *0.870/0.849* | *0.905/0.854* | 0.807/0.798 | 0.670/0.650 | **0.835/0.854** | *0.851/0.844* | *0.670/0.650* |\n| DDA (ours) | **0.998/0.998** | **0.990/0.991** | **0.992/0.993** | **0.972/0.971** | **0.982/0.981** | **0.989/0.990** | 0.969/0.972 | *0.824/0.841* | **0.965/0.967** | **0.824/0.841** |\n\n\n> *Q3: The mechanism for choosing a decision threshold is not discussed in the paper.*\n\nThank you for pointing this out. We clarify that our DDA-based binary classifier uses **a fixed decision threshold of 0.5**: samples with predicted logits greater than 0.5 are classified as synthetic, and those below as real. No threshold tuning or calibration is applied during evaluation."}, {"review_id": "qbX8Oitf4U", "reviewer": "Reviewer_Two9", "summary": "This paper proposes Dual Data Alignment (DDA), a method to improve the generalization of AI-generated image detectors by aligning real and synthetic images in both pixel and frequency domains. Unlike prior work that only aligns pixel-level content, DDA also corrects frequency-level biases that detectors may exploit. The authors demonstrate that detectors trained on DDA-aligned data significantly outperform baselines across diverse benchmarks, including unseen generative models and real-world datasets. Two new datasets, DDA-COCO and EvalGEN, are also introduced for robust evaluation.", "questions": "See the weakness part.", "limitations": "See the weakness part.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths:**\n\n1. Proposes a dual-domain alignment (pixel + frequency), addressing overlooked frequency-level biases in existing methods.\n1. Achieves strong generalization across 8 diverse benchmarks, outperforming prior state-of-the-art detectors.\n1. The DDA method is efficient to implement and significantly reduces training data generation time.\n\n\n\n**Weaknesses:**\n\n1. Since using VAE reconstruction to build training datasets has already been proposed in [1], the main novelty of this paper, to my understanding, lies in two aspects: (i) **Frequency-Level Alignment**, which replaces high-frequency DCT coefficients of synthetic images with those from real images; and (ii) **Pixel-Level Alignment**, a mixup-style operation applied between real and synthetic images.\n2. Regarding the first point, I have two main concerns. First, it is unclear whether the authors apply the DCT transform at the original image resolution or in 8×8 blocks—this is not explicitly specified in the paper. Second, the authors appear to define the high-frequency region as a bottom-right rectangle in the DCT space. However, DCT coefficients increase in frequency in a zigzag pattern from the top-left to the bottom-right. As such, this rectangular selection might omit some high-frequency components, making the design potentially suboptimal.\n3. For the second point, while mixup is a well-established technique in image classification, it has not been applied in AIGI detection before, so I acknowledge this as a valid contribution. However, in Fig. 9(c), the ablation results show that even when rpixel=0rpixel=0 or rpixel=1rpixel=1, the detector still achieves high accuracy. This is counterintuitive—could the authors clarify why extreme values still perform well?\n4. The detector is fine-tuned using DINOv2 with an input size of 336×336. It would be helpful for the authors to include ablations on different commonly used backbones (e.g., CLIP, ResNet-50) and input sizes (e.g., 224×224), since most baselines are trained under these settings. Also, any justification for selecting DINOv2 as the backbone would be appreciated.\n5. The proposed method appears to be model-agnostic. Can the authors demonstrate whether DDA-aligned data could also enhance performance when used to train other existing detection methods?\n\n**In summary**, this paper tackles a critical challenge in AIGI detection—robust generalization in real-world scenarios—and achieves state-of-the-art performance across multiple benchmarks. However, several technical and design questions remain to be addressed.\n\n\n\n[1] Aligned Datasets Improve Detection of Latent Diffusion-Generated Images, ICLR'25", "was_revised": true, "final_justification": "I have read the author's response, and most of the concerns have been addressed. The only remaining concern is the issue raised in Q1 regarding High-Frequency Region Selection. Although the `rectangular-0.5` setting shows performance similar to the `zigzag` method, this choice is not theoretically convincing, as it does not align with the high-frequency distribution of the DCT and may miss some compressed high-frequency components. \n\nI hope the authors will provide a more in-depth discussion or revise the corresponding method in the revised version. Compared to the overall contribution of this paper, this minor concern does not overshadow its merits. I am willing to update my rating to `accept` after discussion. Good luck!", "rebuttal": "Thank you for acknowledging **strong gneralization** and **efficiency** of our proposed DDA. We will alleviate your remaining concerns.\n\n---\n\n> *Q1: Regarding the first point, I have two main concerns. First, it is unclear whether the authors apply the DCT transform at the original image resolution or in 8×8 blocks—this is not explicitly specified in the paper. Second, the authors appear to define the high-frequency region as a bottom-right rectangle in the DCT space. However, DCT coefficients increase in frequency in a zigzag pattern from the top-left to the bottom-right. As such, this rectangular selection might omit some high-frequency components, making the design potentially suboptimal.*\n\nThank you for your pointting that concern.\n\n* **DCT Resolution:** We clarify that the DCT transform in our method is applied in 8×8 blocks, consistent with the standard JPEG compression pipeline. This design reflects a practical consideration: real images in most datasets (e.g., GenImage, ForenSynth) are JPEG-compressed, while many synthetic images are stored in PNG format. Applying block-wise DCT allows us to more effectively capture and mitigate compression-related frequency biases.\n\n* **High-Frequency Region Selection:** Below we conduct additional experiments using a **zigzag-pattern-based frequency selection**. As shown in Table 1 below, DDA with \\$T\\_{\\text{freq}} = 0.2\\$ (zigzag) achieves a comparable performance to \\$T\\_{\\text{freq}} = 0.5\\$ (rectangular). This suggests that our method is robust to the precise frequency indexing scheme. We will clarify both the DCT resolution and the frequency selection strategy in the revised manuscript.\n\n**Table 1. Ablation study of DDA using zigzag-based vs. rectangular high-frequency region selection.**\n\n| T_freq   | GenImage   | DRCT-2M   | DDA-COCO   | EvalGEN   | Synthbuster   | Chameleon   | SynthWildx   | Avg      |\n|:---------|:-----------|:----------|:-----------|:----------|:--------------|:------------|:-------------|:---------|\n| zigzag-0.1      | **96.4**   | 96.7      | 93.1       | 93.2      | *93.8*        | 72.5        | 82.2         | 89.7     |\n| zigzag-0.2      | **96.4**    | **98.5**  | 94.8       | 94.1      | 93.6          | *73.8*      | *83.1*       | **90.6** |\n| zigzag-0.3      | 94.0       | 95.8      | *94.9*     | 94.1      | 92.4          | 71.9        | 82.5         | 89.4     |\n| zigzag-0.4      | 92.3       | 93.3      | *94.9*     | *94.6*    | 92.6          | 72.5        | 80.8         | 88.7     |\n| zigzag-0.5      | 91.2       | 92.4      | **97.3**   | **95.1**  | 90.6          | 69.1        | 79.2         | 87.8     |\n| rectangular-0.5 | 95.5       | *97.4*    | 94.3       | 94.0      | **94.6**      | **74.3**    | **84.0**     | **90.6** |\n\n---\n\n> *Q2: For the second point, while mixup is a well-established technique in image classification, it has not been applied in AIGI detection before, so I acknowledge this as a valid contribution. However, in Fig. 9(c), the ablation results show that even when rpixel=0 or rpixel=1, the detector still achieves high accuracy. This is counterintuitive—could the authors clarify why extreme values still perform well?*\n\nThank you again for your careful reading and constructive feedback. We apologize for the confusion caused by the x-axis notation in Fig. 9 (c). The label should be **\\$R\\_{\\text{pixel}}\\$**, consistent with the figure caption. Specifically:\n\n* **\\$R\\_{\\text{pixel}} = 0.0\\$** means **no pixel-level mixup is applied** (i.e., frequency alignment only).\n* **\\$R\\_{\\text{pixel}} = 1.0\\$** means the pixel-level mixup ratio \\$r\\_{\\text{pixel}}\\$ is **sampled from a uniform distribution \\$U\\[0, 1]\\$** during training (see Eq 3 of main paper).\n\nThe strong performance at \\$R\\_{\\text{pixel}} = 0\\$ is not contradictory. It reflects the fact that **frequency-domain alignment alone is already highly effective**—achieving 91% accuracy in our ablation—since VAE reconstructions provide substantial low-level alignment. Similarly, the strong performance at **\\$R\\_{\\text{pixel}} = 1.0\\$** aligns with expectations. We will correct the axis label in Fig. 9 and add this clarification in the revision.\n\n---\n\n> *Q3: The detector is fine-tuned using DINOv2 with an input size of 336×336. It would be helpful for the authors to include ablations on different commonly used backbones (e.g., CLIP, ResNet-50) and input sizes (e.g., 224×224), since most baselines are trained under these settings. Also, any justification for selecting DINOv2 as the backbone would be appreciated.*\n\n**A** Thank you for your comment. We clarify that **we have already provided ablation studies on both input sizes (Appendix Table 6) and backbone architectures (Appendix Table 7)**. \n\n* **Input Sizes:** Table 2 presents results for input resolutions of **224, 252, 280, 336, 392, 448, and 504**. The results show that DDA remains consistently effective across all tested resolutions.\n\n* **Backbones:** Table 3 compares DINOv2 and CLIP ViT-B/16. We observe that **DINOv2 outperforms CLIP**, likely due to its stronger focus on low-level, pixel-sensitive features that are more effective for capturing DDA-aligned artifacts. In contrast, CLIP is optimized for high-level semantics. We also attempted to train DDA with ResNet-50, but it failed to converge—likely due to insufficient representational capacity for modeling subtle DDA-induced artifacts.\n\n**Table 2. Ablation study of DDA across different input sizes.**\n| Input Size | GenImage | DRCT-2M  | DDA-COCO | EvalGEN  | Synthbuster | Chameleon | SynthWildx | Avg |\n|-------|--------|--------|----------|----------|-------|--------|---------|----------------|\n| 224   | 94.9   | 96.7   | **95.9** | **97.2** | 88.9 | 71.9   | 80.3    | 89.4 ± 9.8     |\n| 252   | 95.3   | 96.7   | 95.0     | 94.1     | 92.4  | 72.0   | 84.0    | 89.9 ± 8.9     |\n| 280   |**95.7**| 96.2   | *95.6*   | 95.4     | 91.9  | 70.1   | 84.6    | 89.9 ± 9.7     |\n| 392   | 92.9   | 96.5   | 92.0     | 95.7     | 93.9  | 71.8   | *89.6*  | *90.3 ± 8.5*   |\n| 448   | 93.4   | *97.2* | 90.7     | 89.5   |**95.8**| 65.7    |**89.9**| 88.9 ± 10.6    |\n| 504   | 93.0   | 93.0   | 92.7     | *95.8*   | 93.3  |*73.2*  | 86.2    | 89.6 ± 7.8     |\n|**336**| *95.5*|**97.4** | 94.3     | 94.0    | *94.6*|**74.3**| 84.0    | **90.6 ± 8.4** |\n\n\n**Table 3. Ablation study of DDA across different backbones.**\n| Method    | Backbone            | GenImage | DRCT-2M  | DDA-COCO | EvalGEN  | Synthbuster | Chameleon | SynthWildx | Avg            |\n| --------- |-------------------- | -------- | -------- | -------- | -------- | ----------- | --------- | ---------- | -------------- |\n| Fatformer |CLIP ViT-L/14        | 62.8     | 52.2     | 49.9    | 45.6     | 56.1        | 51.2      | 52.1       | 52.8 ± 5.4     |\n| UnivFD    |CLIP ViT-L/14        | 64.1     | 61.8     | 51.4     | 15.4     | 67.8        | 50.7      | 52.3       | 51.9 ± 17.5    |\n| DRCT   |CLIP ViT-L/14        | 84.7     | *90.5*     | 62.3     | 77.7     | *84.8*      | 56.6      | 55.1       | 73.1 ± 14.8    |\n| C2P-CLIP |CLIP ViT-L/14        | 74.4     | 59.2     | 49.9     | 38.9     | 68.5        | 51.1      | 57.1       | 57.0 ± 11.9    |\n| AIDE      |CLIP ConvNeXt| 61.2| 64.6  | 50.0     | 15.0     | 53.9        | 63.1      | 48.8       | 50.9 ± 17.1    |\n| DDA       |CLIP ViT-B/16        | 95.2     | 80.3     | *97.9*   | *96.2*     | 55.5        | 46.6      | 62.0       | 76.2 ± 21.4    |\n| DDA       |CLIP ViT-L/14        | **97.0** | 80.4     | **98.8**| **99.2** | 68.3        | *67.7*    | *71.8*     | *83.3 ± 14.7*  |\n| DDA       |**DINOv2 VIT-L/14** | *95.5*   | **97.4** | 94.3    | 94.0     | **94.6**     | **74.3** | **84.0**   | **90.6 ± 8.4** |\n\n---\n\n> *Q4: The proposed method appears to be model-agnostic. Can the authors demonstrate whether DDA-aligned data could also enhance performance when used to train other existing detection methods?*\n\nThanks for your insightful comment. To assess whether DDA-aligned data benefits existing detection models, we conducted additional experiments that **isolate the effect of DDA**. Specifically, we replaced the synthetic training images in baseline methods with **DDA-aligned counterparts**, while keeping all other components—including model architecture, training settings, and loss functions—unchanged. The results, summarized in **Table 4**, show **consistent and significant improvements in accuracy**, confirming that DDA-aligned data enhances generalization\n\n**Table 4. Evluation of baseline methods with and without DDA-aligned synthetic data.**\n\n| Method          | GenImage         | DRCT-2M          | DDA-COCO         | EvalGEN          | Chameleon        | WildRF          |  AVG             |\n|-----------------|------------------|------------------|------------------|------------------|------------------|-----------------|------------------|\n| UnivFD       |  64.1            | 61.8             | 51.4             | 15.4             | 50.7             | 55.3            | 49.8             |\n| UnivFD + DDA    |**92.4 (↑28.3)** | **76.1 (↑14.3)** | **78.2 (↑26.8)**| **98.7 (↑83.3)**| **65.6 (↑14.9)**| **56.6 (↑1.3)** |**77.9 (↑28.1)** |\n| Fatformer   |  62.8            | 52.2             | 49.9             | 45.6             | 51.2             | 58.9            | 53.4             |\n| Fatformer + DDA | **65.5 (↑2.7)** | **58.9 (↑6.7)**  | **68.6 (↑18.7)**| **77.0 (↑31.4)**| **54.0 (↑2.8)** | 51.3 (↓7.6)      | **62.6 (↑9.2)** |\n| DRCT        |  84.7            | 90.5             | 62.3             | 77.7             | 56.6             | 50.6            | 70.4             |\n| DRCT + DDA      | **91.7 (↑7.0)** | 86.2 (↓4.3)       |**77.3 (↑15.0)** | **97.2 (↑19.5)**| **68.0 (↑11.4)**| **54.8 (↑4.2)** | **79.2 (↑8.8)** |"}]

Author rebuttal:

Meta-review: The recommendation is based on the reviewers' comments, the area chair's evaluation, and the author-reviewer discussion. 

This paper proposes a dual data alignment (DDA) approach for both pixel and frequency domains. The resulting synthetically generated images are shown to be effective in improving the detection performance of various AI-generated image classifiers. All reviewers find the studied setting novel and the results provide new insights. The major concern of the initial version was on the fair evaluation versus baselines, given that the baseline detectors were trained on different datasets. The authors’ rebuttal has successfully addressed the major concerns of reviewers, by providing a controlled experiment (one-to-one comparison) on baseline models with and without DDA.

In the post-rebuttal phase, most reviewers were satisfied with the authors’ responses and agreed on the decision of acceptance. Overall, I recommend acceptance of this submission. I also expect the authors to include the new results and suggested changes during the rebuttal phase in the final version.

Also, given that the proposed method is quite generic and improves different AIGI detectors at large with notable gains, I recommend for spotlight presentation.
Decision: Accept (spotlight)