The rapid advancement of generative models has made the detection of AI-generated images a critical challenge for both research and society. Recent works have shown that most state-of-the-art fake image detection methods overfit to their training data and catastrophically fail when evaluated on curated hard test sets with strong distribution shifts. In this work, we argue that it is more principled to learn a tight decision boundary around the real image distribution and treat the fake category as a sink class. To this end, we propose SimLBR, a simple and efficient framework for fake image detection using Latent Blending Regularization (LBR). Our method significantly improves cross-generator generalization, achieving up to +24.85% accuracy and +69.62% recall on the challenging Chameleon benchmark. SimLBR is also highly efficient, training orders of magnitude faster than existing approaches. Furthermore, we emphasize the need for reliability-oriented evaluation in fake image detection, introducing risk-adjusted metrics and worst-case estimates to better assess model robustness. All code and models will be released on HuggingFace and GitHub.
Figures & tables
Figure 1: t-SNE Visualization of Latent Blending Regularization: Prior methods tend to overfit to generator-specific artifacts, leading to fake images from unseen models being misclassified as real. Incorporating LBR encourages the detector to learn a tighter boundary around the real image distribution ( blue / orange cluster), ensuring that any sample lying outside this region—regardless of its generative source—is correctly identified as fake.
Figure 2: Framework of SimLBR: Our model samples either a real or a fake label for a real image in the training set. If a fake label is sampled, we blend small amounts of fake image information in a pretrained latent space. Solving this objective forces the model to learn a tighter decision boundary around the unperturbed real image distribution enabling better generalization to unseen generative models.
Method
SD v1.4 (Training)
Midjourney
SD v1.5
ADM
GLIDE
Wukong
VQDM
BigGAN
Mean ↑
Std ↓
Rel. ↑
ResNet-50
99.90
54.90
99.70
53.50
61.90
98.20
56.60
52.00
72.09
22.70
0.97
DeiT-S
99.90
55.60
99.80
49.80
58.10
98.90
56.90
53.50
71.56
23.29
0.92
Swin-T
99.90
62.10
99.80
49.80
67.60
99.10
62.30
57.60
74.78
21.17
1.17
CNNSpot
96.30
52.80
95.90
50.10
39.80
78.60
53.40
46.80
64.21
22.63
0.62
Spec
99.40
52.00
99.20
49.70
49.80
94.80
55.60
49.80
68.79
24.14
0.77
F3Net
99.90
50.10
99.90
49.90
50.00
99.90
49.90
49.90
68.69
25.85
0.72
Table 1: Evaluation on GenImage Dataset: Following protocols from prior work, we train using the Stable Diffusion 1.4 model and evaluate on other models. We outperform the SoTA models on 5 out of 7 testset models. Most importantly, we see the largest gains when evaluating on BigGAN. While other deepfake detectors rapidly deteriorate when evaluated on an out-of-distribution GAN-based model, SimLBR shows superior generalization, which is further reflected in its standard deviation and reliability scores.
Method
CNNSpot
FreDect
Fusing
LNP
LGrad
UnivFD
DIRE-G
DIRE-D
PatchCraft
NPR
AIDE
SimLBR
ProGAN (Training)
100.0
99.36
100.0
99.67
99.83
99.81
95.19
52.75
100.0
99.79
99.99
99.29
StyleGAN
90.17
78.02
85.2
91.75
91.08
84.93
83.03
51.31
92.77
97.70
99.64
87.38
BigGAN
71.17
81.97
77.4
77.75
85.62
95.08
70.12
49.7
95.80
84.35
83.95
95.52
CycleGAN
87.62
78.77
87.0
84.1
86.94
98.33
74.19
49.58
70.17
96.1
98.48
88.11
StarGAN
94.6
94.62
97.0
99.92
99.27
95.75
95.47
46.72
99.97
99.35
99.91
88.54
GauGAN
81.42
80.57
77.0
75.39
78.46
99.47
67.79
51.23
71.58
82.5
73.25
97.14
Table 2: Evaluation on AIGC Dataset: Following prior work, we train using ProGAN and evaluate on 15 other generative models. SimLBR performs well across all models, ranking third-highest in average accuracy. It is the most consistent and reliable model with the lowest standard deviation and the highest reliability score. SimLBR is also the only model to consistently perform above 75% , across all generative models, depicting a relatively generator-agnostic behavior.
Training Dataset
CNNSpot
FreDect
Fusing
GramNet
LNP
UnivFD
DIRE
PatchCraft
NPR
AIDE
SimLBR
ProGAN
56.94
55.62
56.98
58.94
57.11
57.22
58.19
53.76
57.29
58.37
84.33
0.08/99.67
13.72/87.12
0.01/99.79
4.76/99.66
0.09/99.97
3.18/97.83
3.25/99.48
1.78/92.82
2.20/98.70
5.04/98.46
75.80 /90.74
SD v1.4
60.11
56.86
57.07
60.95
55.63
55.62
59.71
56.32
58.13
62.60
85.57
8.86/98.63
1.37/98.57
0.00/99.96
17.65/93.50
0.57/97.01
74.97/41.09
11.86/95.67
3.07/96.35
2.43/100.00
20.33/94.38
92.96 /80.06
Table 3: Evaluation on hard testset Chameleon: We evaluate on the testset Chameleon, which is composed of specifically picked hard-to-detect samples. We report the total accuracy and fake/real accuracy for all settings. All existing models exhibit significant deterioration in accuracy and recall. SimLBR, however, maintains its performance, showing strong robustness to generator distribution shifts.
CNNSpot
UnivFD
DIRE
PatchCraft
AIDE
SimLBR
GenImage
50.10
55.20
50.10
72.40
66.89
88.00
AIGC
50.45
50.75
49.74
70.17
73.25
75.54
Table 4: Worst Case Performance Estimates: This table shows the lowest performance of a detector across all testset generators. This metric serves as an upper bound for the worst-case performance of a detector. SimLBR shows the best worst-case estimate across both AIGC and GenImage generators, suggesting it is more dependable when deployed in real-world settings.
ProGAN
SD v1.4
DiffusionSat
Backbone
LBR
Chameleon
AIGC
Chameleon
GenImage
RSFake
Mean Acc. ↑
Mean Rec. ↑
Std ↓
Reliability ↑
WCE ↑
DINOv2
✗
56.12 0.64/97.83
70.77 44.45/97.09
62.04 60.73/63.78
86.74 77.02/95.29
-
68.92
45.71
13.31
1.42
56.12
DINOv2
✓
55.77 4.13/94.58
74.75 57.71/91.78
62.02 39.23/79.14
81.49 70.75/90.94
-
68.51
42.95
11.71
1.57
55.77
DINOv3
✗
59.65 7.24/99.03
76.70 54.07/99.33
87.79 89.03/86.86
92.19 85.80/97.81
73.90 48.28/99.52
78.05
58.88
12.77
2.19
59.65
DINOv3
✓
84.33 75.80/90.74
88.40 82.07/93.97
85.57 92.96/80.06
94.54 93.89/95.05
88.88 78.87/99.29
88.26 ( +10.21 )
84.72 ( +25.84 )
3.94 ( -8.83 )
9.70 ( +7.51 )
84.33 ( +24.68 )
Table 5: Ablation of SimLBR: We ablate the impact of latent blending regularization and the latent space used for blending. For each setting, we report the total accuracy and fake/real accuracy. LBR significantly improves the accuracy and recall performance in the DINOv3 space. Furthermore, it achieves much better reliability scores and worst-case estimates, resulting in more reliable and robust detectors. However, the choice of latent space is an important consideration in SimLBR as DINOv2 does not achieve the same performance boost.
Figure 3: (a) Ablation of α : We train SimLBR using ProGAN and different sampling distributions for α . Always retaining at least half the information from the real image is one of the optimal and robust choices for sampling α . (b) Ablation of MLP: We try different sizes of MLP. SimLBR performs better with smaller MLPs and overfits with large number of hidden layers.
GenImage
AIGC
ID
OD
ID
OD
w/o LBR
94.37
77.70
85.58
73.26
w/ LBR
95.47
88.00
91.50
85.98
Gain
1.10
10.30
5.92
12.72
Table 6: Average accuracy on ID vs. OD testsets: We ablate the impact of using Latent Blending Regularization on In-Distribution (ID) and Out-Distribution (OD) generative testsets. ID testset contains generators that share architectural similarities with the training generator, whereas OD testset contains generators with substantially different architectures. We observe the most significant gains from LBR in the OD testset, reasserting that LBR encourages the model to learn a generator-agnostic decision boundary.
Method
Original
JPEG Compression
Gaussian Blur
QF=95
QF=90
QF=75
QF=50
σ=1.0
σ=2.0
σ=3.0
σ=4.0
CNNSpot
70.78
64.03
62.26
60.65
59.66
68.39
67.26
67.13
65.85
FreDect
64.03
66.95
67.45
66.64
65.33
65.75
66.48
68.58
69.64
Fusing
68.38
62.43
61.39
59.34
57.41
68.09
66.69
66.02
65.58
LNP
83.84
53.58
54.09
53.02
52.85
67.91
66.42
66.2
62.69
LGrad
75.34
51.55
51.39
50.00
50.00
71.73
69.12
68.43
66.22
Table 7: Robustness to JPEG Compression and Gaussian Blur: Following prior work, we evaluate the robustness of our model when different amounts of JPEG Compression and Gaussian Blur are applied to the input images. SimLBR is highly robust, showing minimal degradation even under strong image perturbations.
Figure 11
Figure 5: Comparison with OC-SVM: We train a One-Class SVM using ProGAN and SD v1.4 images and evaluate on AIGC and GenImage benchmarks, respectively. SimDLR clearly outperforms the outlier detector approach when using the same latent features.
The rapid advancement of image generation models has made it increasingly difficult for people to distinguish AI-generated images from real ones. To prevent the potential risks associated with the misuse of fake images, AI-generated image detection has gained significant attention. Existing methods neglect the inherent differences between real and fake images, thus lacking robustness and generalization ability. In this work, we innovatively investigate AI-generated image detection using bit-planes, and introduce the bit-reversed image. We propose a simple yet effective pipeline consisting of construction of bit-reversed images, gradient-based patch selection and a convolutional classifier. Besides, we provide a theoretical analysis from the mathematical perspective to demonstrate the validity of our approach. We also introduce two challenging datasets for AI-generated image detection. Extensive experiments verify the effectiveness of our approach across different settings, including cross-generator generalization, cross-dataset generalization and zero-shot performance. Without bells and whistles, our approach outperforms existing methods on over 40 benchmarks, and is nearly 100 times faster than counterparts. The code is at https://github.com/renxi-seu/RAID.
Renxi Cheng, Jie Gui, Hongsong Wang
School of Cyber Science and Engineering, Southeast University, Nanjing 210096, China · Purple Mountain Laboratories, Nanjing 210000, China · Engineering Research Center of Blockchain Application, Supervision And Management (Southeast University), Ministry of Education, China +2
The rapid advancement of generative models has blurred the boundary between synthetic and real imagery, creating an urgent need for reliable deepfake detection. Yet most existing approaches rely on massive real--fake datasets, which are increasingly difficult to maintain as new generators continue to emerge. In this work, we investigate how much information about image authenticity is already encoded in modern multimodal vision representations. We find that frozen multimodal encoders naturally separate real and synthetic images in their embedding space, enabling a simple linear classifier to achieve strong performance without task-specific fine-tuning. Motivated by this observation, we develop a representation-aware data curation strategy that selects a compact set of representative generators for training. The resulting training set contains only 10K images, compared to 288K in AIGIBench and 4M in OpenFake, while improving robustness to unseen generators and distribution shifts. We additionally introduce RealWorldBench, a benchmark consisting of modern camera photographs, contemporary stock images, and outputs from recent commercial generators. Experiments across multiple benchmarks show that combining frozen multimodal representations with carefully curated training data provides a simple and effective approach to AI-generated image detection.
Generalization remains a critical bottleneck in AI-generated image detection. Because many modern generators are proprietary or adversarially modified, existing detectors overfit to the low-level textural patterns of accessible training data, resulting in severe failures on unseen domains. Conventional regularization techniques (e.g., L1/L2 norms, Dropout) apply indiscriminate parametric constraints and fail to provide the domain-invariant structure necessary for cross-generator robustness. To address this, we propose Feature-Augmented Implicit Regularization (FAIR). FAIR introduces an orthogonal, macro-structural prior, specifically, Scene Composition Structure (SCS), during training to geometrically constrain the model's optimization trajectory. By augmenting the primary feature space with domain-invariant SCS features, FAIR explicitly penalizes texture-biased shortcut learning. Crucially, this structural prior is entirely discarded at inference, yielding a smoothed, generalized decision boundary with zero architectural or computational overhead. Extensive evaluations across five massive benchmarks demonstrate that integrating FAIR into state-of-the-art detectors significantly improves cross-generator generalization, boosting accuracy by up to 8.04% and establishing new state-of-the-art robustness in zero-shot transfer scenarios.
Md Redwanul Haque, Manzur Murshed, Manoranjan Paul +1
Deakin University, Burwood, VIC, Australia · Charles Sturt University, Bathurst, NSW, Australia