Title: Breaking Latent Prior Bias in Detectors for Generalizable AIGC Image Detection
Venue: NeurIPS 2025
Accepted: yes
Keywords: Multimedia Forensics

AIGC Image Detection
Abstract: Current AIGC detectors often achieve near-perfect accuracy on images produced by the same generator used for training but struggle to generalize to outputs from unseen generators. We trace this failure in part to latent prior bias: detectors learn shortcuts tied to patterns stemming from the initial noise vector rather than learning robust generative artifacts. To address this, we propose \textbf{On-Manifold Adversarial Training (OMAT)}: by optimizing the initial latent noise of diffusion models under fixed conditioning, we generate \emph{on-manifold} adversarial examples that remain on the generator’s output manifold—unlike pixel-space attacks, which introduce off-manifold perturbations that the generator itself cannot reproduce and that can obscure the true discriminative artifacts. To test against state-of-the-art generative models, we introduce GenImage++, a test-only benchmark of outputs from advanced generators (Flux.1, SD3) with extended prompts and diverse styles. We apply our adversarial-training paradigm to ResNet50 and CLIP baselines and evaluate across existing AIGC forensic benchmarks and recent challenge datasets. Extensive experiments show that adversarially trained detectors significantly improve cross-generator performance without any network redesign. Our findings on latent-prior bias offer valuable insights for future dataset construction and detector evaluation, guiding the development of more robust and generalizable AIGC forensic methodologies.


Peer reviews:
comments: SUMMARY:
This paper identifies latent prior bias in AIGC detectors by proposing an on-manifold adversarial attack that perturbs initial noise in diffusion models to bypass detection, revealing vulnerabilities in existing forensic methods. The authors introduce OMAT, an adversarial training framework that enhances detector robustness by learning from these on-manifold adversarial examples, achieving state-of-the-art generalization across diverse generators.

STRENGTHS AND WEAKNESSES:
Strength

- The writing is good and easy to follow.
    
- The proposed Latent Prior Bias Attack is novel and essential.
    
- The method is simple but effective. The experiment is extensive and the evaluation results seems good.

Weakness

- As a data augmentation approach, demonstrating OMAT’s performance on various baselines (rather than only ResNet or CLIP+Linear) would better illustrate its effectiveness.
    
- What specific benefits does the proposed method offer in terms of robustness enhancement? It would be better to explicitly compare against alternative methods, like using images generated with various random seeds.
    
- The accuracy on real-world images appears unexpectedly low (Table 2). Could the authors provide more analysis on potential factors contributing to this performance limitation?
    
- Table 3 lacks a comparison with the original CLIP+LoRA.

QUESTIONS:
See weakness

LIMITATIONS:
Yes
TITLE: Official Review
CLARITY: 2
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-01

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper tackles a significant challenge in AI-generated content (AIGC) detection: the inability of detectors to generalize across unseen generative models. The authors identify latent prior bias as a critical factor, whereby detectors tend to learn shortcuts specific to certain generative models rather than features that are generalizable. To address this, the paper introduces On-Manifold Adversarial Training (OMAT), a technique that generates adversarial examples by perturbing the latent space of diffusion models. These perturbations remain on the generative manifold, unlike pixel-space attacks, which create off-manifold noise. Additionally, the paper presents GenImage++, a new benchmark designed to evaluate AIGC detectors against advanced generative models, including Flux.1 and Stable Diffusion 3 (SD3). Experiments show that detectors trained with adversarial examples achieve state-of-the-art generalization across various benchmarks.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n1. Novel Contribution: The paper offers a novel perspective by exposing latent prior bias in AIGC detectors and proposing OMAT, which directly targets latent noise vectors. This approach improves generalization across unseen generative models without relying on large datasets or complex reconstruction pipelines.\n2. Comprehensive Evaluation: The experiments are thorough, comparing the proposed method with various baseline detectors and adversarial training techniques. The introduction of the GenImage++ dataset is a valuable contribution, highlighting the capabilities of contemporary generative models.\n3. Practical Impact: The proposed method significantly enhances detector generalization, marking a meaningful advancement in the development of robust forensic tools capable of detecting AI-generated content across diverse models.\n4. Strong Results: The paper demonstrates that detectors trained with OMAT show substantial improvements in cross-generator performance, particularly when evaluated against advanced generators. These findings underscore the importance of addressing latent prior bias to achieve more robust and generalized AIGC detection.\n\n### Weaknesses\n1. Computational Cost: The on-manifold latent optimization attack requires substantial computational resources, particularly in terms of VRAM usage. While this is understandable given the complexity of the task, it may limit the scalability of the method for large-scale applications or for researchers without access to high-end hardware.\n2. Lack of Detailed Error Analysis: Although the experiments are extensive, a more in-depth error analysis, especially regarding the failure cases of detectors post-adversarial training, would offer additional insight into the robustness of the proposed methods. Understanding these edge cases could help refine the approach.\n3. Limited Comparison with Non-Diffusion Models: The paper primarily focuses on diffusion models like Stable Diffusion and Flux but does not compare performance with a broader range of generative models, such as GAN-based generators or VAEs. Including such models would provide a more comprehensive evaluation of the approach.\n4. Dependence on Differentiable Preprocessing: The need for differentiable preprocessing limits the method's applicability to detectors using non-differentiable preprocessing pipelines. While the paper acknowledges this limitation, it may still hinder broader adoption of the method.\n5. Benchmark Accessibility: Although the GenImage++ dataset is presented as a key contribution, it is unclear whether it will be publicly accessible. Ensuring easy access to this dataset would benefit the community by enabling others to replicate experiments and further test the effectiveness of the proposed methods.\n6. I recommend that the authors also evaluate AEROBLADE[1] and LaRE^2[2] on the benchmark.\n\n[1] AEROBLADE: Training-Free Detection of Latent Diffusion Images Using Autoencoder Reconstruction Error\n\n[2] LaRE^2: Latent Reconstruction Error Based Method for Diffusion-Generated Image Detection\n\nQUESTIONS:\nSee weaknesses.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-01"}

comments: SUMMARY:
This paper analyzes the impact of noise in generative models on the performance of detection systems and proposes a method to generate on-manifold adversarial examples through targeted noise attacks on generative models. These adversarial examples are incorporated into the training of detectors to enhance their detection performance.

 The method involves a detailed analysis of the generation mechanism of generative models and designs a detection strategy accordingly, demonstrating strong originality. A new dataset is also introduced, reflecting the significant amount of work conducted. Overall, the writing is fluent and professional, with well-presented and sufficient figures and tables.

STRENGTHS AND WEAKNESSES:
Strengths

1. Proposes the On-Manifold Adversarial Training method based on the working principle of diffusion models, optimizing noise for improved generalization in detection, and achieving excellent generalization performance.

2. Introduces the GenImage++ test dataset, which includes images generated by advanced generators (such as Flux.1 and Stable Diffusion 3) under extended text prompts and diverse styles.


Weaknesses

1. The experiments mainly focus on diffusion models. It would be beneficial to include experiments on additional datasets, as the current experimental coverage is somewhat limited.

QUESTIONS:
1. The method is designed based on the generation principles of diffusion models. However, why does the performance on BigGAN also improve significantly after incorporating the CLIP encoder?

LIMITATIONS:
Yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-01

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper first uncovers a latent prior bias in AIGC detectors by crafting on-manifold white-box attacks that exploit the detector’s reliance on initial noise, demonstrating how this shortcut undermines cross-generator generalization. It then introduces On-Manifold Adversarial Training (OMAT), which augments detector training with zₜ-optimized adversarial examples to force the model to learn truly robust generative artifacts, yielding significant improvements in out-of-domain performance. Additionally, the authors introduce GenImage++, a challenging test-only dataset comprising outputs from advanced generators (e.g., Flux.1, SD3) produced with diverse prompting strategies.\n\nSTRENGTHS AND WEAKNESSES:\n- **Strengths**：  \n  - Identification of a Core Vulnerability: The paper identifies a significant vulnerability in existing AIGC (AI-Generated Content) detectors, which is the latent prior bias. This bias leads to detectors being overly reliant on specific latent features, making them susceptible to targeted attacks that exploit this weakness.\n\n  - Simple yet Effective Training Framework: To mitigate this bias, the authors introduce OMAT, which employs on-manifold adversarial examples for detector training. Despite its conceptual simplicity, OMAT directly addresses the identified shortcoming and delivers substantial performance gains.\n\n  - Sharp analysis of results: The paper is careful in dissecting why OMAT works, linking improved generalization to acquired robustness against the specific latent-based attacks. OMAT achieves superior cross-generator generalization compared to both traditional and state-of-the-art baselines. And the ablation in Table 5 (Section 6.6) is illustrative and shows that on-manifold adversarial examples result in much stronger generalization improvements compared to traditional pixel-space adversarial examples.\n\n- **Weaknesses**：  \n  - While the paper focuses on visual perturbations, it does not explore the potential of on-manifold adversarial attacks in the text-conditioning pathway. This could limit the applicability of OMAT to scenarios where text conditioning plays a significant role.\n\n  - Introducing a small experiment that gradually varies the number (or proportion) of on-manifold adversarial examples during training could help clarify how sensitive OMAT’s performance is to the adversarial sample budget. A brief analysis of performance trends as this budget increases would strengthen understanding of the method’s robustness.\n\n  - The Related Work section is somewhat narrow, covering only a few detector types that may be relevant to the shortcut proposed in this work.\n\n  - The attack framework depends on Kornia’s differentiable preprocessing, which may limit OMAT’s applicability to more diverse detectors.\n\nQUESTIONS:\n- Have you considered including an experiment that progressively increases the proportion of on-manifold adversarial examples during training? Such a study would clarify OMAT’s sensitivity to adversarial-sample scaling.\n\n - Could you clarify whether the text-conditioning pathway exhibits a similar latent-prior shortcut? In particular, have you applied on-manifold perturbations to the textual prompts and evaluated their impact on detector robustness?\n\n - Would you consider expanding the Related Work section to cover recent advances in latent-space forensic analysis, few-shot learning, and patch-based methods for AIGC detection?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper tackles the well-known poor cross-generator generalization of AI-generated-image (AIGC) detectors. The authors introduce On-Manifold Adversarial Training (OMAT), which uses optimized latent seeds to generate realistic adversarial examples and retrain detectors. This approach significantly improves cross-generator performance without changing model architecture. A new benchmark, GenImage++, demonstrates OMAT’s strong generalization to advanced generative models.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- The paper clearly articulates the notion of “latent prior bias” and illustrates it with a white-box latent-space attack that is easy to understand and implement.\n- Empirical results on both the standard GenImage benchmark and the newly curated GenImage++ set show noticeable gains in cross-generator accuracy.\n\nWeaknesses:\n- On-manifold adversarial training was proposed and discussed in [31] and Xiao et al. “Understanding Adversarial Robustness Against On-manifold Adversarial Examples.” The paper is the first to apply it to AIGC detection, but the conceptual novelty is incremental.\n- There is no formal proof connecting “latent prior bias” to generalization; the evidence presented is purely empirical.\n- Ablations vary LoRA rank and compare with pixel-space FGSM/PGD/MI-FGSM, but critical factor such as attack steps, step-size, guidance scale are not ablated.\n- The attack used to generate training data assumes white-box access and requires approximately 79 GB of GPU memory per image, which makes the threat model unrealistic for most real-world adversaries.\n\nQUESTIONS:\n- The authors could consider comparing with recent universal detectors such as RIGID on GenImage and GenImage++, and evaluating whether the OMAT-trained detector remains robust when test images are further perturbed by latent-space evasion attacks such as StealthDiffusion.\n- Since the detector is trained only on SD v1.4 images, the reported improvements may stem from increased exposure to hard negatives rather than from a true mitigation of latent prior bias.\n\nPlease refer to the weaknesses above for additional questions and suggestions.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-03"}