Title: Training-free Detection of AI-generated images via Cropping Robustness
Venue: NeurIPS 2025
Accepted: yes
Keywords: AI-generated image detection

Training-free

self-supervised model

RandomResizedCrop
Abstract: AI-generated image detection has become crucial with the rapid advancement of vision-generative models. Instead of training detectors tailored to specific datasets, we study a training-free approach leveraging self-supervised models without requiring prior data knowledge. These models, pre-trained with augmentations like $\texttt{RandomResizedCrop}$, learn to produce consistent representations across varying resolutions. Motivated by this, we propose $\textbf{WaRPAD},$ a training-free AI-generated image detection algorithm based on self-supervised models. Since neighborhood pixel differences in images are highly sensitive to resizing operations, WaRPAD first defines a base score function that quantifies the sensitivity of image embeddings to perturbations along high-frequency directions extracted via Haar wavelet decomposition. To simulate robustness against cropping augmentation, we rescale each image to a multiple of the model’s input size, divide it into smaller patches, and compute the base score for each patch. The final detection score is then obtained by averaging the scores across all patches. We validate WaRPAD on real datasets of diverse resolutions and domains, and images generated by 23 different generative models. Our method consistently achieves competitive performance and demonstrates strong robustness to test-time corruptions. Furthermore, as invariance to $\texttt{RandomResizedCrop}$ is a common training scheme across self-supervised models, we show that WaRPAD is applicable across self-supervised models.


Peer reviews:
comments: SUMMARY:
This paper proposes WaRPAD (Wavelet, Resizing, and Patchifying for AI-generated image Detection), a training-free method for detecting AI-generated images. The core insight leverages the inherent robustness of self-supervised vision models to the RandomResizedCrop  augmentation used during their pre-training.

STRENGTHS AND WEAKNESSES:
Strengths 
The paper presents a highly innovative concept – exploiting the inherent RRC invariance learned by self-supervised models on real data as a discriminative signal for AI-generated image detection. 

Weaknesses
1. Need Cross-dataset experiments. For example, training on GenImage, and testing on Deepfake-LSUN-Bedroom。
2. While WaRPAD excels on average, Tables 2 & 3 show it can be slightly outperformed by AEROBLADE on specific models (e.g., Midjourney in Synthbuster, SDv1.4 in GenImage). Analyzing the characteristics of images/models where WaRPAD struggles slightly more could be informative.

QUESTIONS:
See Weaknesses

LIMITATIONS:
See Weaknesses
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-06-28

comments: SUMMARY:
This paper presents WaRPAD, a training-free method for detecting AI-generated images using self-supervised models. The key idea is that real images produce more stable embeddings under RandomResizedCrop (RRC) transformations, while synthetic images are more sensitive to such changes—especially in high-frequency areas. WaRPAD uses Haar wavelet decomposition to measure this sensitivity and computes a detection score by analyzing patches of resized images. The method works without any training, performs well across many generative models and datasets, and shows strong robustness to test-time image corruptions.

STRENGTHS AND WEAKNESSES:
Strength: 
1. The paper presents a clear and well-motivated problem, making it easy to follow the overall idea and reasoning behind the proposed approach.
2. It proposes a training-free detection pipeline that combines RandomResizedCrop-based perturbation and Haar wavelet analysis to compute embedding sensitivity scores on self-supervised models. The method is simple yet effective, and the experimental results are very promising across various generative models.
3. The ablation study is thorough and convincing, demonstrating the contribution of each component and validating the effectiveness of the proposed design.

Weakness:
While the paper compares against several training-free methods, it does not benchmark against recent supervised detectors or fine-tuned models, which would help establish the trade-off between accuracy and efficiency more clearly.

QUESTIONS:
The weakness is not really a weakness. But I would like to see some comparisons with supervised detectors on most recent gen-ai model (Flux for example).

LIMITATIONS:
No negative societal impact.
TITLE: Official Review
CLARITY: 4
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-02

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes WaRPAD, a training-free method for detecting AI-generated images by leveraging self-supervised models (e.g., DINOv2, CLIP) and their robustness to RandomResizedCrop (RRC) augmentation. It measures sensitivity to high-frequency perturbations via Haar wavelet decomposition. It uses multi-scale patching to simulate RRC effects, achieving strong performance and robustness across diverse generative models and image corruptions.\n\nSTRENGTHS AND WEAKNESSES:\nStrength\n1) The paper is well-constructed, and the writing is of good quality.\n2) The method is simple but effective. The experiment is extensive, and the evaluation results seem good.\n3) The method is a training-free method and does not require additional training data. These advantages address a real open problem in the generated image detection domain.\n\nWeakness\n1) The main idea of WaRPAD is quite similar to RIGID, which limits its novelty.\n2) The motivation of HFwav(x) (Line-148) appears unclear. I would like the authors to provide additional theoretical analysis demonstrating how HFwav(x) reflects the model's robustness to RRC.\n3) As shown in Figure 2, the high-frequency components seem to correlate primarily with the proportion of detailed content in images. If this is the case, would the paper's hypothesis only apply to images with abundant details? For instance, when both real and generated images have low content complexity (i.e., fewer high-frequency details), would WaRPAD remain effective?\n4) Considering that ImageNet and LSUN (real-world datasets) images undergo post-processing operations, while synthetic data might not receive similar preprocessing, the effectiveness of WaRPAD might stem from detecting post-processing artifacts rather than synthetic artifacts. Notably, WaRPAD focuses on high-frequency differences between real and fake images. However, in the robustness experiments, the authors applied the same post-processing intensity to both real and synthetic images. This could still preserve inherent differences in post-processing characteristics (e.g., noise levels) between datasets.\n\nQUESTIONS:\nSee weakness.\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-07"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nPaper tackles AI generated image detection. Their contention is that real image distributions that current detection approaches can effectively cover remains extremely limited compared to the diversity of generated images. Growing need for detection methods that can operate universally across diverse domains without relying on the constraints of predefined real image distributions.\n\nThe paper leverages the fact that self-supervised models like DINO and DINOv2 are trained (a) solely on real images (b) are adversarially trained to be robust to random cropping and resizing (RRC), via (stronger global view) teacher (weaker augmented) student self-distillation. The main hypothesis of the paper is that embeddings of any AI generated image computed using this self-supervised model would be less robust to random cropping and resizing. This is due to a subsequent hypothesis, which is reasonably well known, that generative models do not model high frequency distributions well (yet).\n\nThe paper proposes a Haar-wavelet perturbation sensitivity score – for real images this score is likely to be higher. This is because the self-supervised model is robust to multiple scales and cropping augmentation for real-images. Then for an input image, they rescale it to some random value and patchify it, and average the score over each patch. This score is the WaRPED score acting as a one-class anomaly classifier.\n\nThen the paper compares the methods to other training-free methods and shows improvement. Seems like using a self-supervised model trained to be robust to RRC is key, as their score and rescaling-strategy with RIGID only marginally improves results.\n\nSTRENGTHS AND WEAKNESSES:\n1.\tThe motivation and the hypotheses makes sense. DINO and DINOv2 are both trained solely on real data (can be verified from the paper’s data mix), so generated images are OOD. The idea boils down to repurposing DINOv2 weights as a one-class classifier – which is a standard anomaly detection trick. But the challenge is to do this in a training free manner. This line of work makes a lot more sense to me than the ones using diffusion models – self-supervised models are carefully trained on real data (unlike \"web scale\" diffusion models), and that distribution is likely more constrained. A \"membership check\" on this distribution is a good way to identify anomalies.\n\n2.\tThe method also makes intuitive sense. DINO objective is to do self-distillation with an augmented student which is fed local crops and a teacher is which is fed global images – thus it will be robust to cropping and resizing. For an OOD sample, that the invariant is likely to not hold. \n\n3.\tMotivation of Haar-wavelet perturbation score. The authors also identify the reason for this OOD behaviour, generative models trained to match real image distributions can’t model high frequency well. This is quite well known. I think they should cite some analysis papers here to support their argument. But it all makes sense.\n\n4.\tComparison and results appear to be fair, they have tested a variety of methods and datasets. Ablations are also reasonable and cover most common questions.\n\nWeaknesses\n\n5.\tExploits a known property of existing generative models, and handcrafts a score function to be training-free. However, I’m not sure if that’s a good idea, why should this OOD classifier be training free and handcrafted, if we have deepfake datasets available to train on. Of course, one can leverage the DINO representations in that case too, by keeping it fixed. However, I’ll not penalize this specific paper too much on this, given that there is prior literature in the “training free” space, and this limitation likely applies to all of them. But I’d like the authors to answer the question for me, as I think this is an important baseline. In their introduction, the contention that “real image distributions that current detection approaches can effectively cover remains extremely limited compared to the diversity of generated images” is not shown.\n\n6.\tThe ablations and analysis can be more clearly written – the main points do not come out as effectively as the introduction and the method section.\n\nQUESTIONS:\n1.\tWhy handcraft the objective? Can you show either prior work or comparisons with trained methods that use self-supervised models? It seems like training a fixed DINO with an OOD classifier on top would be even better and achieve zero-shot generalization to all these datasets (this matches recent experience of many recent paper in a variety of domains -- e.g VGGT). The nice thing about a training approach is that it does not rely on a handcrafted signal, hopefully other signals (e.g. biological signals [a]) would not be correctly modelled by generative models when generating images in the future for us to be able to detect them reliably.\n\n2.\tToday, generative models do not model high frequency image components well, that may not be true tomorrow. Any suggestions on how to overcome that limitation?\n\n[a] FakeCatcher: Detection of Synthetic Portrait Videos using Biological Signals\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-08"}