NS-Net: Decoupling CLIP Semantic Information through NULL-Space for Generalizable AI-Generated Image Detection

Jiazhen Yan; Fan Wang; Ziwen He; Ziqiang Li; Zhangjie Fu

cs.CVAug 2, 2025

NS-Net: Decoupling CLIP Semantic Information through NULL-Space for Generalizable AI-Generated Image Detection

Authors: Jiazhen Yan, Fan Wang, Ziwen He, Ziqiang Li, Zhangjie Fu

Organizations: Engineering Research Center of Digital Forensics, Ministry of Education, Nanjing University of Information Science and Technology, Nanjing, 210044, China. · University of Macau, Macau, 999078, China.

Abstract

The rapid progress of generative models, such as GANs and diffusion models, has facilitated the creation of highly realistic images, raising growing concerns over their misuse in security-sensitive domains. While existing detectors perform well under known generative settings, they often fail to generalize to unknown generative models, especially when semantic content between real and fake images is closely aligned. In this paper, we revisit the use of CLIP features for AI-generated image detection and uncover a critical limitation: the high-level semantic information embedded in CLIP's visual features hinders effective discrimination. To address this, we propose the NS-Net, a novel detection framework that leverages NULL-Space projection to decouple semantic information from CLIP's visual features, followed by contrastive learning to capture intrinsic distributional differences between real and generated images. Furthermore, we design a Patch Selection strategy to preserve fine-grained artifacts by selecting patches with the highest and lowest spectral entropy. Extensive experiments on an open-world benchmark comprising images generated by 47 diverse generative models show that NS-Net outperforms existing state-of-the-art methods, achieving a 5.0% improvement in detection accuracy, thereby demonstrating strong generalization across both GAN- and diffusion-based image generation techniques. Our code is available at https://github.com/HorizonTEL/NS-Net.

Figures & tables

Fig. 1: T-SNE Visualization of Features Extracted from the Matched Dataset and the Mismatched Dataset . The CLIP effectively separates real and generated images when semantic alignment is weak but struggles when the semantic content of both is closely aligned. Only applying the NULL-Space decoupling to features from the frozen CLIP’s image encoder results in a clear separation between real and generated images while reducing the influence of semantic content on forgery detection.

Fig. 2: Architecture of NS-Net for Generalizable AI-Generated Image Detection . Specifically, we first employ the Patch Selection strategy adjusted for CLIP’s input size to preserve potential forgery-related artifacts. Subsequently, the visual features extracted by the CLIP’s image encoder are projected onto the NULL-Space of the semantic information, effectively removing task-irrelevant semantic components. The resulting features, tailored for the detection task, are then utilized in a contrastive learning framework, which can not only guide the linear classification layer but also capture the intrinsic distributional differences between real and AI-generated images, enhancing the model’s ability to generalize beyond simple classification.

Method	Real Image	Generative Adversarial Networks							Other		Diffusion Models								mAcc.
Method	Real Image	Pro- GAN	Cycle- GAN	Big- GAN	Style- GAN	Style- GAN2	Gau- GAN	Star- GAN	WFIR	Deep- fake	SDv1.4	SDv1.5	ADM	GLIDE	Mid- journey	Wukong	VQDM	DALLE2	mAcc.
CNN-Spot [ 32 ]	99.0	95.3	18.7	1.8	36.5	22.0	2.5	23.1	1.1	29.3	55.9	55.6	1.8	4.8	5.2	27.6	0.7	4.5	29.0
UnivFD [ 16 ]	92.3	98.9	90.5	79.2	55.7	48.7	91.1	96.9	92.8	26.9	96.3	96.0	12.7	75.6	61.2	84.7	45.6	62.3	72.7
FreqNet [ 13 ]	89.9	99.4	57.1	51.0	75.1	67.5	9.9	88.4	95.4	35.8	99.9	99.8	37.7	78.9	80.8	98.0	34.1	88.8	71.7
NPR [ 25 ]	99.3	98.9	29.3	16.5	67.1	58.7	1.7	6.5	7.9	0.1	100.0	99.9	26.5	69.2	71.0	97.7	15.4	89.8	53.1
Ladeda [ 26 ]	99.8	99.7	7.2	29.0	95.6	98.3	4.9	0.0	19.2	0.1	100.0	99.9	27.3	79.7	88.8	97.9	15.5	92.4	58.6

TABLE I: Cross-model Accuracy (Acc.) Performance on the AIGCDetectBench [ 23 ] Dataset. The first column represents the accuracy of detecting real images (R.Acc.), and the others are the accuracy of detecting fake images (F.Acc.).

Method	Generative Adversarial Networks							Other		Diffusion Models								mA.P.
Method	Pro- GAN	Cycle- GAN	Big- GAN	Style- GAN	Style- GAN2	Gau- GAN	Star- GAN	WFIR	Deep- fake	SDv1.4	SDv1.5	ADM	GLIDE	Mid- journey	Wukong	VQDM	DALLE2	mA.P.
CNN-Spot [ 32 ]	99.9	91.0	59.2	94.8	94.2	86.1	82.5	65.5	74.2	97.6	97.6	66.6	83.1	80.4	88.9	57.0	87.8	84.3
UnivFD [ 16 ]	99.9	90.5	79.2	55.7	48.7	91.1	96.9	92.8	26.9	96.3	96.0	65.2	95.3	91.7	97.4	87.2	62.3	91.9
FreqNet [ 13 ]	99.4	97.5	87.9	95.9	94.2	54.0	100.0	57.0	88.5	99.9	99.9	73.9	94.1	94.4	99.1	74.9	92.3	88.4
NPR [ 25 ]	100.0	98.6	79.4	98.6	99.6	71.3	97.6	65.5	92.5	100.0	99.9	74.1	97.4	97.8	99.9	81.5	99.3	91.4
Ladeda [ 26 ]	100.0	91.5	93.2	100.0	100.0	81.8	93.0	86.9	72.8	100.0	99.9	77.3	99.1	99.7	100.0	89.3	99.8	93.2

TABLE II: Cross-model Average Precision (A.P.) Performance on the AIGCDetectBench [ 23 ] Dataset.

Method	Guided		Glide_50_27		Glide_100_10		Glide_100_27		LDM_100		LDM_200		LDM_200_cfg		DALLE		Mean
Method	F.Acc.	A.P.	F.Acc.	A.P.	F.Acc.	A.P.	F.Acc.	A.P.	F.Acc.	A.P.	F.Acc.	A.P.	F.Acc.	A.P.	F.Acc.	A.P.	R.Acc.	F.Acc.	Acc.	A.P.
CNN-Spot [ 32 ]	3.0	70.8	4.6	76.9	4.6	78.0	5.1	76.8	21.4	88.7	24.1	90.1	36.1	93.8	3.5	62.7	99.8	12.8	56.3	79.7
UnivFD [ 16 ]	35.5	81.0	79.1	92.5	80.0	92.1	79.6	92.3	75.9	91.4	76.0	91.4	57.7	84.7	49.1	80.3	89.8	66.4	78.1	88.2
FreqNet [ 13 ]	40.9	78.5	80.4	97.8	81.1	97.9	78.2	97.6	96.6	99.7	97.6	99.8	96.1	99.7	40.1	93.1	97.9	76.4	87.6	95.5
NPR [ 25 ]	29.5	83.0	61.9	99.3	60.6	99.0	59.9	99.3	76.1	99.9	73.9	99.9	89.3	100.0	27.3	98.9	99.9	59.8	79.8	97.4
Ladeda [ 26 ]	39.5	89.0	69.4	99.6	71.6	99.4	72.4	99.7	74.3	99.9	75.7	99.9	85.3	99.9	9.2	96.4	100.0	62.2	81.1	98.0

TABLE III: Cross-Diffusion-Sources Evaluation on the Diffusion Test Set of UniversalFakeDetect [ 16 ] .

Generator	CNN-Spot [ 32 ]	UnivFD [ 16 ]	FreqNet [ 13 ]	NPR [ 25 ]	Ladeda [ 26 ]	AIDE [ 48 ]	DFFreq [ 27 ]	SAFE [ 22 ]	VIB-Net [ 20 ]	Ours
Real Image	98.0	73.2	65.8	93.8	97.1	88.1	91.7	92.2	60.8	88.0
R3GAN	2.3	94.1	59.9	8.4	19.5	99.0	78.4	93.0	79.3	98.5
StyleGAN3	9.1	82.6	98.2	63.6	93.2	91.1	95.5	94.6	89.8	99.6
StyleGAN-XL	0.7	96.7	95.5	28.2	80.5	91.7	15.6	89.4	99.8	99.3
StyleSwim	6.9	98.1	97.1	77.7	97.3	82.0	99.8	99.9	98.4	99.8
FLUX1-dev	16.3	86.6	92.4	97.2	99.3	90.0	96.1	99.5	60.5	96.2

TABLE IV: Cross-model Accuracy (Acc.) Performance on the AIGIBench [ 54 ] Dataset. The first row represents the accuracy of detecting real images (R.Acc.), and the others are the accuracy of detecting fake images (F.Acc.).

Method	LlamaGen		Janus-Pro		VAR		Infinity		Open-MAGVIT2		Switti		RAR		Mean
Method	Acc.	A.P.	Acc.	A.P.	Acc.	A.P.	Acc.	A.P.	Acc.	A.P.	Acc.	A.P.	Acc.	A.P.	Acc.	A.P.
CNN-Spot [ 32 ]	50.9	72.4	63.3	91.6	50.1	61.5	63.4	94.5	50.2	58.2	54.3	81.9	50.6	68.7	54.7	75.5
UnivFD [ 16 ]	71.2	85.0	80.7	91.3	61.1	74.9	91.8	97.0	59.3	72.7	91.2	96.9	83.2	93.2	76.9	87.3
FreqNet [ 13 ]	90.3	96.9	95.6	99.8	78.3	89.2	95.5	99.7	76.4	88.3	95.3	99.8	80.8	91.7	87.5	95.1
NPR [ 25 ]	83.5	97.5	97.0	99.8	81.8	98.6	89.7	99.5	55.7	82.0	99.4	100.0	67.7	93.6	82.1	95.9
Ladeda [ 26 ]	89.4	99.6	99.6	100.0	80.5	98.7	99.8	100.0	78.0	99.0	99.8	100.0	87.1	99.6	90.6	99.5

TABLE V: Cross-source Accuracy (Acc.) and Average Precision (A.P.) Performance on the ARForensics Dataset.

Patch Selection	NULL-Space Decoupling	Contrastive Learning	AIGCDetect- Bench	AIGIBench
✗	✗	✗	81.2	71.4
✓	✗	✗	82.8	74.7
✗	✓	✗	85.3	79.8
✗	✗	✓	84.2	77.8
✓	✗	✓	87.5	80.4
✓	✓	✓	93.2	87.0

TABLE VI: Ablation Study on the AIGCDetectBench [ 23 ] and AIGIBench [ 54 ] Dataset.

Selection Strategy	AIGCDetectBench	AIGIBench
Resize	78.6	70.1
CenterCrop	89.1	75.9
PatchShuffle	87.3	76.9
PatchCraft	77.1	60.3
Random 2k patches	88.4	81.2
Top 2k patches	85.8	75.1

TABLE VII: Selection Strategy Comparison on the AIGCDetectBench [ 23 ] and AIGIBench [ 54 ] Datasets.

Method	JPEG Compression			Gaussian Blur
Method	QF=95	QF=85	QF=75	$\sigma=0.5$	$\sigma=1.0$	$\sigma=1.5$
UnivFD	76.4	74.2	73.8	80.2	76.8	76.3
NPR	72.8	70.7	69.2	80.6	79.6	81.0
AIDE	74.6	74.1	70.3	88.6	75.8	81.1
SAFE	57.7	59.6	60.4	88.5	80.6	83.0
VIB-Net	82.2	80.8	79.0	86.1	81.1	81.6

TABLE VIII: Robustness on JPEG Compression and Gaussian Blur of Our Method on the AIGCDetectBench [ 23 ] Dataset.

Method	JPEG Compression			Gaussian Blur
Method	QF=95	QF=85	QF=75	$\sigma=0.5$	$\sigma=1.0$	$\sigma=1.5$
UnivFD	65.6	66.3	65.9	72.2	68.6	68.6
NPR	59.0	58.9	58.6	62.9	62.0	62.9
AIDE	61.0	59.6	55.9	75.5	63.4	65.2
SAFE	51.3	47.9	47.8	75.5	67.6	69.3
VIB-Net	62.9	61.9	63.0	66.5	62.6	62.6

TABLE IX: Robustness on JPEG Compression and Gaussian Blur of Our Method on the AIGIBench [ 54 ] Dataset.

Method	SDv1.4	SDv1.5	ADM	GLIDE	Midjourney	Wukong	VQDM	DALLE2	mAcc.
UnivFD [ 16 ]	96.3	96.0	12.7	75.6	61.2	84.7	45.6	62.3	66.8
+NULL-Space	97.8	97.4	59.5	74.9	65.9	95.4	81.4	73.0	$80.7_{+13.9}$
VIB-Net [ 20 ]	100.0	99.8	52.8	69.3	63.7	99.3	80.9	58.5	78.0
+NULL-Space	100.0	99.8	55.1	72.3	68.0	99.5	83.3	63.3	$80.2_{+2.2}$
Ours w/o NULL-Space	100.0	99.9	73.1	90.7	72.3	99.3	91.0	90.4	89.6
Ours	100.0	99.9	85.3	97.2	77.4	100.0	98.9	98.8	$94.7_{+5.1}$

TABLE X: Plug & Play Application of NULL-Space Decoupling on Existing Detectors on the AIGCDetectBench [ 23 ] Dataset.

Method	SDv1.4	SDv1.5	ADM	GLIDE	Midjourney	Wukong	VQDM	DALLE2	mAcc.
DFFreq [ 16 ]	99.9	99.8	65.9	87.8	94.8	99.1	76.0	95.9	89.9
+Patch Selection	99.9	99.9	69.1	93.2	89.5	99.6	84.2	96.3	$91.5_{+1.6}$
SAFE [ 22 ]	99.8	99.6	36.8	90.5	86.3	98.5	84.0	92.0	85.9
+Patch Selection	100.0	99.8	54.1	95.3	95.8	99.4	84.4	97.7	$90.7_{+4.8}$
VIB-Net [ 20 ]	100.0	99.8	52.8	69.3	63.7	99.3	80.9	58.5	78.0
+Patch Selection	100.0	99.9	73.9	85.3	66.8	99.0	83.9	79.6	$86.1_{+8.1}$

TABLE XI: Plug & Play Application of Patch Selection on Existing Detectors on the AIGCDetectBench [ 23 ] Dataset.

Models	AIGCDetectBench	AIGIBench
ClipCap	91.2	82.7
Qwen-7B	93.2	85.7
BLIP	93.2	87.0

TABLE XII: Impact of Text Description Quality on the AIGCDetectBench [ 23 ] and AIGIBench [ 54 ] Dataset.

Fig. 3: T-SNE Visualization of Features Extracted before Classifier . We compare the VIB-Net, Effort and our NS-Net. A total of four testing GANs and diffusion models are considered, including SDXL, FLUX, R3GAN, and Guided. VIB-Net does not adequately represent semantic content, leading to difficulties when encountering unseen models, while the pre-training knowledge retained by Effort still affects generalization performance to some extent. In contrast, our method demonstrates superior discrimination, effectively separating different categories, even when encountering unseen sources.

AI-Generated Image Detection

AI-generated image detection identifies synthetic or AI-edited images and develops methods that generalize across generators, domains, and image transformations.

See all 194 papers

Sep 24, 2026

EIB-Net: Entropy-Guided Information Bottleneck for Generalizable AI-Generated Image Detection

The proliferation of photorealistic AI-generated images demands robust detection methods that generalize across diverse generative models. While existing approaches target manipulation-based forgeries with local artifacts, generation-based images (e.g., from diffusion models) lack such traces, posing a fundamental challenge. We observe that generative models prioritize global semantics at the expense of local texture fidelity, making low-texture regions key indicators of synthetic origin. To exploit this, we propose EIB-Net, an Entropy-guided Information Bottleneck Network. EIB-Net introduces a novel Image Entropy (IE) metric to automatically select the most informative (lowest-entropy) patch, then processes it with a Variational Information Bottleneck (VIB) to learn compact, generalizable features. Extensive experiments on DIFF, DiffusionForensics, and GenImage benchmarks demonstrate state-of-the-art performance: EIB-Net achieves 85.7% accuracy using only 2% of training data, outperforming full-image baselines by over 15%, and maintains robust cross-generator generalization (83.5% average accuracy on GenImage). Furthermore, our entropy-guided patch selection (EGPL) consistently enhances diverse backbones (CNNs and Transformers), proving its practical value for data-efficient detection.

Zhida Zhang, Xinlei Ma, Jie Cao

School of Artificial Intelligence, UCAS & NLPR, CASIA Beijing, China · School of Advanced Interdisciplinary Sciences, UCAS & NLPR, CASIA Beijing, China · NLPR, Institute of Automation, Chinese Academy of Sciences Beijing, China

AI-Generated Image Detection Variational Information Bottleneck

Ask PDF

Jul 24, 2026

FAIR: Feature-Augmented Implicit Regularization for AI-generated Fake Image Detection

Generalization remains a critical bottleneck in AI-generated image detection. Because many modern generators are proprietary or adversarially modified, existing detectors overfit to the low-level textural patterns of accessible training data, resulting in severe failures on unseen domains. Conventional regularization techniques (e.g.,

L_1

L_2

norms, Dropout) apply indiscriminate parametric constraints and fail to provide the domain-invariant structure necessary for cross-generator robustness. To address this, we propose Feature-Augmented Implicit Regularization (FAIR). FAIR introduces an orthogonal, macro-structural prior, specifically, Scene Composition Structure (SCS), during training to geometrically constrain the model's optimization trajectory. By augmenting the primary feature space with domain-invariant SCS features, FAIR explicitly penalizes texture-biased shortcut learning. Crucially, this structural prior is entirely discarded at inference, yielding a smoothed, generalized decision boundary with zero architectural or computational overhead. Extensive evaluations across five massive benchmarks demonstrate that integrating FAIR into state-of-the-art detectors significantly improves cross-generator generalization, boosting accuracy by up to 8.04% and establishing new state-of-the-art robustness in zero-shot transfer scenarios.

Md Redwanul Haque, Manzur Murshed, Manoranjan Paul +1

Deakin University, Burwood, VIC, Australia · Charles Sturt University, Bathurst, NSW, Australia

Domain Generalization AI-Generated Image Detection Implicit Regularization

Ask PDF

May 24, 2026

Where Detectors Fail: Probing Generative Space for Generalizable AI-Generated Image Detection

Detecting AI-generated images (AIGI) remains challenging because detectors often fail to generalize to unseen generators. Although existing methods are trained on large datasets, their performance still degrades when generation settings change, indicating that data scale alone is insufficient and that limited coverage of generative variations during training is a key factor. Studies on generative model editing show that small changes in internal representations can produce diverse and meaningful image variations, many of which are not explored under standard sampling. Leveraging this insight, we propose PROBE (Probing Robustness via Boundary Exploration), a framework that improves detector generalization by actively exploring challenging regions of the generative process. Instead of treating the generator as a fixed data source, PROBE uses the detector as a critic to steer the generator through manifold-level modifications, producing realistic samples that are difficult to classify. These samples expose failure cases that are uncommon under standard data sampling strategies and are used to refine the detector. Experimental results across multiple benchmarks indicate that PROBE enhances generalization to unseen generators, resulting in more generalizable AIGI detection performance. Code and models are available at https://github.com/Amamiya-C/PROBE-AIGI-Detection

Zijie Cao, Weijie Tu, Yao Xiao +3

School of Computer Science and Engineering, Sun Yat-sen University, Guangzhou, China · Australian National University, Canberra, Australia · Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China +1

Synthetic Data Augmentation AI-Generated Image Detection

Ask PDF

Abstract

AI-Generated Image Detection

Explore similar work

EIB-Net: Entropy-Guided Information Bottleneck for Generalizable AI-Generated Image Detection

FAIR: Feature-Augmented Implicit Regularization for AI-generated Fake Image Detection

Where Detectors Fail: Probing Generative Space for Generalizable AI-Generated Image Detection