Title: Towards Generalizable Detector for Generated Image
Venue: NeurIPS 2025
Accepted: yes
Keywords: Generated image detection

OOD detection

Learnable OOD detection
Abstract: The effective detection of generated images is crucial to mitigate potential risks associated with their misuse. Despite significant progress, a fundamental challenge remains: ensuring the generalizability of detectors. To address this, we propose a novel perspective on understanding and improving generated image detection, inspired by the human cognitive process: Humans identify an image as unnatural based on specific patterns because these patterns lie outside the space spanned by those of natural images. This is intrinsically related to out-of-distribution (OOD) detection, which identifies samples whose semantic patterns (i.e., labels) lie outside the semantic pattern space of in-distribution (ID) samples. 
  By treating patterns of generated images as OOD samples, we demonstrate that models trained merely over natural images bring guaranteed generalization ability under mild assumptions.
  This transforms the generalization challenge of generated image detection into the problem of fitting natural image patterns. 
  Based on this insight, we propose a generalizable detection method through the lens of ID energy. Theoretical results capture the generalization risk of the proposed method. Experimental results across multiple benchmarks demonstrate the effectiveness of our approach.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a framework for detecting generated images by reframing the problem as an Out-of-Distribution (OOD) detection task. The authors propose Differential Energy-based Detection (DEnD), which leverages the differential energy scores computed via a self-supervised pretrained model (DINOv2). The core insight is that natural images (ID data) will have low differential energy scores, while generated images (OOD data) will have high scores. The paper provides theoretical guarantees of generalizability and conducts extensive experiments across several benchmarks (ImageNet, LSUN-BEDROOM, GenImage, AIGCDetectBenchmark, Sora). The results indicate that DEnD achieves state-of-the-art performance among training-free methods and often outperforms training-based detectors.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths:**\n\n- The paper presents a fresh perspective by casting generated image detection as an OOD detection problem.\n\n- DEnD eliminates the need for task-specific training, relying on pretrained self-supervised models. This reduces training costs and mitigates overfitting risks.\n\n- The experiments cover a wide range of generative models, including unseen and unknown architectures (e.g., Sora).\n\n**Weaknesses:**\n\n\n- The success of DEnD is strongly dependent on the representational capacity of the selected pretrained model, particularly DINOv2. Although the authors provide comparisons with alternative self-supervised models (e.g., CLIP, DINO), these alternatives significantly underperform, confirming the reliance on DINOv2 and limiting flexibility in model choice.\n\n- While the theoretical framing—casting generated image detection as an OOD detection problem—is novel, the proposed method itself represents a relatively straightforward application of differential energy scoring using existing self-supervised representations. The algorithmic contribution beyond the reframing and score definition is incremental.\n\n- The method assumes that generated images consistently exhibit high differential energy relative to natural images. While this holds in many cases, there is no deep analysis or ablation to test this assumption against high-fidelity generative models or adversarially crafted fakes.\n\n- The code is not released at submission, and reproducibility relies heavily on future promises rather than current availability. Important hyperparameter choices (e.g., transformation distributions, thresholds) are not explored in depth.\n\nQUESTIONS:\n- The authors compare DEnD’s performance across different self-supervised models (e.g., DINO, CLIP, DINOv2) and demonstrate DINOv2’s superiority. Given this dependence, could hybrid or ensemble approaches combining multiple self-supervised representations further improve robustness or mitigate reliance on a single model?\n\n- While the paper includes evaluations on various generative models, including some high-fidelity examples (e.g., StyleGAN-XL, Sora), can the authors provide a more focused analysis of cases where generated images are nearly indistinguishable from natural ones (e.g., Stable Diffusion or future models), and quantify how separation degrades in such scenarios?\n\n- Given the method’s reliance on differential energy scoring, how robust is DEnD to adversarial perturbations applied to natural images that could artificially inflate differential energy scores and lead to misclassification?\n\n- The paper presents extensive ablations and robustness tests but does not report statistical significance measures (e.g., error bars, confidence intervals, or variability across seeds). Could the authors clarify whether multiple trials were conducted and, if so, provide formal statistical analyses to support the reported performance?\n\nLIMITATIONS:\nSee Weaknesses and Questions", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 2, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper frames the problem of AI-generated image detection as an out-of-distribution (OOD) detection problem, where generated images are the out-of-distribution and real (natural) images are in-distribution. Based on this formulation, the paper proposes a novel approach called differential energy-based detection (DEnD) that utilizes a well-known self-supervised model (DINOv2) which only has seen real images in its training phase. DEnD performs AI-generated image detection by calculating the difference of the pre-trained model energy of an input image and it's transformed version ($\\lambda$). Based on the theoretical work, real images exhibit lower $\\lambda$ values than generated images, making it a reliable representation for discerning real vs AI-generated images. Additionally, the paper provides guarantees of generalizability to unseen generative models through theoretical work, a key element missing in previous works. Finally, the proposed method shows strong performance on a variety of datasets and comparing with state-of-the-art baselines.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n1. The paper addresses a timely problem of AI-generated detection through an under-explored perspective and addresses a fundamental limitation of existing works: Ensuring the generalizability of the detectors. \n2. The paper is clear, easy to follow and well-written. The flow of information is logical.\n3. Theoretical work is sound and ensures the proposed method's generalizability to unseen generative models under mild assumptions.\n4. The proposed method for AI-generated image detection is novel and well-motiviated and shows strong performance through experimental validation.\n\n**Weaknesses**\n1. Considering the method is \"training-free\" and utilizes DINOv2, which is trained on ImageNet, it is not clear how the proposed method performs when there is a real data distribution shift at test time.\n2. Although an important aspect for adoption the of proposed method to operational environments, the mechanism of selecting a threshold is ambiguous. It is unclear what does the \"validation\" data in section F include and how the optimal threshold is calculated. Additionally, the process of selecting a threshold for competing methods is not discussed. \nFor more weaknesses refer to the \"Questions\" section.\n\nQUESTIONS:\nI am willing to increase my score to accept or strong accept based on the authors' response to the following unanswered questions:\n\n1. How does the proposed method perform when there is a real data distributional shift between the training dataset of the pre-trained self-supervised model and real test data. For example, DINOv2 is trained on ImageNet, how does the proposed method perform on a dataset consisting of real images from COCO dataset? Is it going to mistake real images from other datasets as OOD (AI-generated) or is it robust to this distributional shift? If any, how significant is the performance drop in this scenario? \n2. How exactly is the threshold selected? What exactly does the validation data mentioned in section F include? How is the optimal threshold calculated? Importantly, how does the accuracy change as a function of the threshold? How sensitive is the accuracy to the validation data?\nWhen comparing with other methods, how the thresholds for those methods are selected?\n3. How does the proposed method perform on other types of video-generaton methods, such as LTX-Video [B] or Meta Movie Gen?\n4. How robust is the method to resizing, a very common post-processing operation? This should be added to section J.\n5. Why the evaluation metrics differ across different experiments? Why are all three metrics not reported in all experiments?\n6. How does the proposed method compare to FSD [B]? This is a recently published detection method which similar to this paper do not require AI-generated training data. Since I do not see their code being public, I think at least a high-level comparison in the background section is valuable. \n\n[A] HaCohen, Yoav, et al. \"Ltx-video: Realtime video latent diffusion.\" arXiv preprint arXiv:2501.00103 (2024).\n\n[B] Nguyen, Tai D et al. \"Forensic self-descriptions are all you need for zero-shot detection, open-set source attribution, and clustering of ai-generated images.\" CVPR 2025\n\nLIMITATIONS:\nI think the limitations should be discussed in more detail. For example, what are the real limitations and failure modes of the proposed method? Answers to some of the questions mentioned in the \"Questions\" section can be added to the \"Limitations\" to inform the reader of the real limitations of the proposed method.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a novel framework for detecting AI-generated images by applying a tailored energy-based out-of-distribution (OOD) detection method to features extracted from self-supervised vision models such as DINOv2 and CLIP. The authors provide theoretical motivation for using energy-based formulations and evaluate their method across various datasets. The supplementary material contains additional experimental details and theoretical analysis.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1.\tNovelty: This is the first work to apply an energy-based OOD method specifically to the task of detecting generated images. The use of energy-based detection methods for generated image detection provides a fresh and promising direction.\n\n2.\tTheoretical Rigor: The authors provide clear theoretical grounding for their method, offering insight into why energy-based scores should help distinguish real from generated content.\n\n3.\tComprehensive Supplementary Material: The appendix includes relevant additional experiments, ablations, and theoretical elaboration that enhance reproducibility and depth.\n\nMajor Weaknesses:\n\n1.\tMissing many recent rlevant works and experimental comparisons: \n\na.\tRigid - Zhiyuan He et al. Rigid: A training-free and model-agnostic framework for robust ai-generated image detection. arXiv preprint arXiv:2405.20112, 2024.  This paper uses DINOv2 and additive Gaussian noise to separate real and generated images and is conceptually close to the proposed work. Despite being unpublished, its relevance makes it appropriate for inclusion in the related work section. A comparison between the simple noise-based approach in Rigid and the energy-based formulation here would strengthen the claim that energy-based scores add meaningful value. \n\nb.\tManifold induce bias detection – J. Brokman et al, “Manifold induced biases for zero-shot and few-shot detection of generated images”, ICLR 2025.  - This is a recent and peer-reviewed zero-shot detection method that predates the submission deadline by approximately four months and offers publicly available code. It is not cited or compared against, which is a critical omission for a paper in this domain.\n\nc.\tZED [7] – Although ZED is briefly mentioned in the related work section, there is no experimental comparison. Given its relevance as a recent zero-shot detection method, a direct comparison is essential to establish the strength and limitations of the proposed approach.\n\nOverall, the absence of experimental comparisons to key recent methods — including ZED, Rigid, and the manifold based detector — makes it difficult to assess the competitiveness and generalizability of this work within the current state of the field. Notably, all three of these methods have been shown to strongly outperform AEROBLADE, as is also demonstrated in this work.\n\n2.\tIncorrect experimental framing: The current experiments do not evaluate real vs. generated image detection directly. Instead, they perform OOD detection between generated images and a single real dataset (e.g., ImageNet or LSUN). These datasets are commonly used in OOD detection tasks and primarily reflect domain shifts rather than generation artifacts, making them unsuitable for evaluating real-versus-generated image detection directly. Proper evaluation should treat all real images as in-distribution and generated images as out-of-distribution, regardless of which real dataset is used for calibration. Additional experiments are needed to confirm that the method generalizes across real domains — specifically, by calibrating the in-distribution (ID) on one real dataset and testing on a different real dataset treated as ID.\n\nMinor Weaknesses:\n\n1.\tClarity on novelty vs. prior work in method section: The method section should more explicitly differentiate between components borrowed from prior OOD methods and those introduced in this work. It would also be valuable to evaluate the proposed approach on standard OOD benchmarks, even if the expected performance is low — this would reinforce the claim that it is purpose-built for detecting generated images rather than general OOD tasks.\n\n2.\tPipeline presentation: While the theoretical formulation is clearly written, the practical method pipeline is difficult to follow. The paper would benefit from a visual figure or algorithm block summarizing the full detection process, from feature extraction to energy computation and thresholding. In particular, the role of the batch size N is unclear — since the detection method should operate independently on each image, the use of a batch suggests possible dependence on other samples. If the method compares the input image to negative examples from the ID dataset, this should be explicitly stated, as it also relates to the concerns raised in Major Weakness 2 regarding evaluation protocol.\n\nQUESTIONS:\nSee above\n\nLIMITATIONS:\nSee above", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis study presents a generalizable detector, Differential Energy-based Detection (DEnD), for detecting AI-generated images by modeling them as out-of-distribution (OOD) samples relative to natural images, inspired by human cognitive patterns. The authors address the generalization issue common in training-based detectors, which may (often) fail on unseen generative models. They argue that while traditional OOD detection leverages classifiers trained on semantic labels, generated image detection cannot rely on such classifiers due to the absence of consistent semantic labels in synthetic data. Instead, they propose using energy-based detection, grounded in the observation that in-distribution (ID) data typically exhibits lower energy scores than OOD data. To implement this idea, the method incorporates self-supervised learning using a pre-trained model (DINOv2) to capture differences between natural and generated image distributions. The model is optimized to minimize the differential energy score for ID data, detecting deviations in generated samples. The paper offers a theoretical foundation supporting the generalizability of the proposed approach and validates it through experiments. The evaluation spans datasets such as ImageNet and LSUN-BEDROOM, as well as generated image benchmarks including GenImage and AIGCDetectBenchmark, and a video dataset produced by Sora. The proposed DEnD method, evaluated using Average Precision (AP) and Area Under the Curve (AUC), outperforming both training-based and training-free baselines in different datasets.\n\nSTRENGTHS AND WEAKNESSES:\na.\tQuality: The submission is technically sound, providing a clear problem statement, theoretical proofs, and experimental evaluations on relevant metrics. The claims are well-supported by both theoretical analysis and experimental results. The methods used are appropriate, and the work is presented as a complete and cohesive study. However, the potential for improvement lies in the detection of images generated by certain models (e.g., SD V1.5 and Wukong), where performance drops were observed. The experiments could be further expanded to include other publicly available datasets, such as the UnivFD dataset (Ojha et al., “Towards Universal Fake Image Detectors That Generalize Across Generative Models”). The authors are transparent in evaluating both the strengths and limitations of their work, and it would be a desirable (though not mandatory) enhancement to explicitly include the observed performance drop on images generated by a few generative models as a stated weakness in the paper.\n\nb.\tClarity: \nThe submission is clearly written and understandable. However, the authors are recommended to refine the following points:\n1. At line 139, remove the full stop after “assumptions”.\n2. In Table 4, there is a typo: “AEROBLADA”; this should be corrected to “AEROBLADE”.\n3. While the paper emphasizes that the model is inspired by human cognitive processes (as mentioned in line 5 and revisited in line 37), this concept is not mentioned again during the model development or in the conclusion. It is desirable to reiterate this point, at least in the conclusion, to help readers stay connected to the central motivation.\n4. At line 161, the use of the word “demonstrated” may be reconsidered. Since the corresponding lemmas are theoretically sound but do not empirically guarantee the claims, it might be more appropriate to state that the generalizability is “hypothetically” or “theoretically” validated.\n5. Regarding the generated image datasets used in Tables 1 and 2, although the GitHub source is provided in the supplementary material (Appendix G), it is recommended to include a formal citation within the main text. For instance, Stein et al., “Exposing flaws of generative model evaluation metrics and their unfair treatment of diffusion models”, could be cited if appropriate.\n6. Although the results section includes qualitative descriptions indicating better performance of the proposed method, it would be helpful to mention specific performance values in the main text where the model clearly outperforms or underperforms compared to baselines.\n\nc.\tSignificance: \nYes, the results are impactful for the community. While the GitHub code has not yet been released, if it is made available, it has the potential to be used by researchers. The work addresses the relevant task of detecting AI-generated images and demonstrates moderately improved performance compared to previous methods. While it does not introduce a new dataset, it does offer improved detection performance and contributes meaningfully to the field.\n\nd.\tOriginality:\nThe work presents a new method for generated image detection by comparing it to several relevant approaches from the forensic detection literature, based on the idea that only real images are used during training. The integration of self-supervised learning via DINOv2 is well-articulated. However, the paper appears to not include a comparison with a relevant method by Liu et al., “Detecting Generated Images by Real Images,” which may offer a meaningful point of reference.\n\nQUESTIONS:\nWhile the work has clear motivation, theoretical validation, a new proposal, and thorough experimental evaluation compared to relevant prior studies, the following comments are suggested to be addressed or at least acknowledged by the authors:\n\na.\tIn line 214, the statement that “self-supervised models... push down the differential energy” would benefit from clarification. It is recommended to either provide a supporting citation or an explanation of the basis for this claim.\nb.\tThe work appears highly relevant to Liu et al., “Detecting Generated Images by Real Images.” It would be desirable to explicitly compare the proposed method to this work, both in terms of conceptual differences and if possible, through experimental results.\nc.\tAlthough not strictly mandatory, it would be informative to include comparative performance on the UnivFD dataset (Ojha et al., “Towards Universal Fake Image Detectors That Generalize Across Generative Models”), which has become one of the standard benchmarks in the field.\nd.\tWhile the authors mention that they will release the code upon acceptance, in the rapidly evolving literature landscape, it is preferable to include code, trained weights, and sufficient documentation at the time of submission or during the rebuttal phase.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-02"}