cs.CVFeb 23, 2026
SaveSimLBR: Learning to Detect Fake Images by Learning to Detect Real Images
Organizations: Washington University in St. Louis · Oak Ridge National Laboratory
Abstract
The rapid advancement of generative models has made the detection of AI-generated images a critical challenge for both research and society. Recent works have shown that most state-of-the-art fake image detection methods overfit to their training data and catastrophically fail when evaluated on curated hard test sets with strong distribution shifts. In this work, we argue that it is more principled to learn a tight decision boundary around the real image distribution and treat the fake category as a sink class. To this end, we propose SimLBR, a simple and efficient framework for fake image detection using Latent Blending Regularization (LBR). Our method significantly improves cross-generator generalization, achieving up to +24.85% accuracy and +69.62% recall on the challenging Chameleon benchmark. SimLBR is also highly efficient, training orders of magnitude faster than existing approaches. Furthermore, we emphasize the need for reliability-oriented evaluation in fake image detection, introducing risk-adjusted metrics and worst-case estimates to better assess model robustness. All code and models will be released on HuggingFace and GitHub.
Figures & tables
Figure 1: t-SNE Visualization of Latent Blending Regularization: Prior methods tend to overfit to generator-specific artifacts, leading to fake images from unseen models being misclassified as real. Incorporating LBR encourages the detector to learn a tighter boundary around the real image distribution ( blue / orange cluster), ensuring that any sample lying outside this region—regardless of its generative source—is correctly identified as fake.
Figure 2: Framework of SimLBR: Our model samples either a real or a fake label for a real image in the training set. If a fake label is sampled, we blend small amounts of fake image information in a pretrained latent space. Solving this objective forces the model to learn a tighter decision boundary around the unperturbed real image distribution enabling better generalization to unseen generative models.
| Method | SD v1.4 (Training) | Midjourney | SD v1.5 | ADM | GLIDE | Wukong | VQDM | BigGAN | Mean | Std | Rel. |
|---|---|---|---|---|---|---|---|---|---|---|---|
| ResNet-50 | 99.90 | 54.90 | 99.70 | 53.50 | 61.90 | 98.20 | 56.60 | 52.00 | 72.09 | 22.70 | 0.97 |
| DeiT-S | 99.90 | 55.60 | 99.80 | 49.80 | 58.10 | 98.90 | 56.90 | 53.50 | 71.56 | 23.29 | 0.92 |
| Swin-T | 99.90 | 62.10 | 99.80 | 49.80 | 67.60 | 99.10 | 62.30 | 57.60 | 74.78 | 21.17 | 1.17 |
| CNNSpot | 96.30 | 52.80 | 95.90 | 50.10 | 39.80 | 78.60 | 53.40 | 46.80 | 64.21 | 22.63 | 0.62 |
| Spec | 99.40 | 52.00 | 99.20 | 49.70 | 49.80 | 94.80 | 55.60 | 49.80 | 68.79 | 24.14 | 0.77 |
| F3Net | 99.90 | 50.10 | 99.90 | 49.90 | 50.00 | 99.90 | 49.90 | 49.90 | 68.69 | 25.85 | 0.72 |
Table 1: Evaluation on GenImage Dataset: Following protocols from prior work, we train using the Stable Diffusion 1.4 model and evaluate on other models. We outperform the SoTA models on 5 out of 7 testset models. Most importantly, we see the largest gains when evaluating on BigGAN. While other deepfake detectors rapidly deteriorate when evaluated on an out-of-distribution GAN-based model, SimLBR shows superior generalization, which is further reflected in its standard deviation and reliability scores.
| Method | CNNSpot | FreDect | Fusing | LNP | LGrad | UnivFD | DIRE-G | DIRE-D | PatchCraft | NPR | AIDE | SimLBR |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ProGAN (Training) | 100.0 | 99.36 | 100.0 | 99.67 | 99.83 | 99.81 | 95.19 | 52.75 | 100.0 | 99.79 | 99.99 | 99.29 |
| StyleGAN | 90.17 | 78.02 | 85.2 | 91.75 | 91.08 | 84.93 | 83.03 | 51.31 | 92.77 | 97.70 | 99.64 | 87.38 |
| BigGAN | 71.17 | 81.97 | 77.4 | 77.75 | 85.62 | 95.08 | 70.12 | 49.7 | 95.80 | 84.35 | 83.95 | 95.52 |
| CycleGAN | 87.62 | 78.77 | 87.0 | 84.1 | 86.94 | 98.33 | 74.19 | 49.58 | 70.17 | 96.1 | 98.48 | 88.11 |
| StarGAN | 94.6 | 94.62 | 97.0 | 99.92 | 99.27 | 95.75 | 95.47 | 46.72 | 99.97 | 99.35 | 99.91 | 88.54 |
| GauGAN | 81.42 | 80.57 | 77.0 | 75.39 | 78.46 | 99.47 | 67.79 | 51.23 | 71.58 | 82.5 | 73.25 | 97.14 |
Table 2: Evaluation on AIGC Dataset: Following prior work, we train using ProGAN and evaluate on 15 other generative models. SimLBR performs well across all models, ranking third-highest in average accuracy. It is the most consistent and reliable model with the lowest standard deviation and the highest reliability score. SimLBR is also the only model to consistently perform above , across all generative models, depicting a relatively generator-agnostic behavior.
| Training Dataset | CNNSpot | FreDect | Fusing | GramNet | LNP | UnivFD | DIRE | PatchCraft | NPR | AIDE | SimLBR |
|---|---|---|---|---|---|---|---|---|---|---|---|
| ProGAN | 56.94 | 55.62 | 56.98 | 58.94 | 57.11 | 57.22 | 58.19 | 53.76 | 57.29 | 58.37 | 84.33 |
| 0.08/99.67 | 13.72/87.12 | 0.01/99.79 | 4.76/99.66 | 0.09/99.97 | 3.18/97.83 | 3.25/99.48 | 1.78/92.82 | 2.20/98.70 | 5.04/98.46 | 75.80 /90.74 | |
| SD v1.4 | 60.11 | 56.86 | 57.07 | 60.95 | 55.63 | 55.62 | 59.71 | 56.32 | 58.13 | 62.60 | 85.57 |
| 8.86/98.63 | 1.37/98.57 | 0.00/99.96 | 17.65/93.50 | 0.57/97.01 | 74.97/41.09 | 11.86/95.67 | 3.07/96.35 | 2.43/100.00 | 20.33/94.38 | 92.96 /80.06 |
Table 3: Evaluation on hard testset Chameleon: We evaluate on the testset Chameleon, which is composed of specifically picked hard-to-detect samples. We report the total accuracy and fake/real accuracy for all settings. All existing models exhibit significant deterioration in accuracy and recall. SimLBR, however, maintains its performance, showing strong robustness to generator distribution shifts.
| CNNSpot | UnivFD | DIRE | PatchCraft | AIDE | SimLBR | |
|---|---|---|---|---|---|---|
| GenImage | 50.10 | 55.20 | 50.10 | 72.40 | 66.89 | 88.00 |
| AIGC | 50.45 | 50.75 | 49.74 | 70.17 | 73.25 | 75.54 |
Table 4: Worst Case Performance Estimates: This table shows the lowest performance of a detector across all testset generators. This metric serves as an upper bound for the worst-case performance of a detector. SimLBR shows the best worst-case estimate across both AIGC and GenImage generators, suggesting it is more dependable when deployed in real-world settings.
| ProGAN | SD v1.4 | DiffusionSat | |||||||||
| Backbone | LBR | Chameleon | AIGC | Chameleon | GenImage | RSFake | Mean Acc. | Mean Rec. | Std | Reliability | WCE |
| DINOv2 | ✗ | 56.12 0.64/97.83 | 70.77 44.45/97.09 | 62.04 60.73/63.78 | 86.74 77.02/95.29 | - | 68.92 | 45.71 | 13.31 | 1.42 | 56.12 |
| DINOv2 | ✓ | 55.77 4.13/94.58 | 74.75 57.71/91.78 | 62.02 39.23/79.14 | 81.49 70.75/90.94 | - | 68.51 | 42.95 | 11.71 | 1.57 | 55.77 |
| DINOv3 | ✗ | 59.65 7.24/99.03 | 76.70 54.07/99.33 | 87.79 89.03/86.86 | 92.19 85.80/97.81 | 73.90 48.28/99.52 | 78.05 | 58.88 | 12.77 | 2.19 | 59.65 |
| DINOv3 | ✓ | 84.33 75.80/90.74 | 88.40 82.07/93.97 | 85.57 92.96/80.06 | 94.54 93.89/95.05 | 88.88 78.87/99.29 | 88.26 ( +10.21 ) | 84.72 ( +25.84 ) | 3.94 ( -8.83 ) | 9.70 ( +7.51 ) | 84.33 ( +24.68 ) |
Table 5: Ablation of SimLBR: We ablate the impact of latent blending regularization and the latent space used for blending. For each setting, we report the total accuracy and fake/real accuracy. LBR significantly improves the accuracy and recall performance in the DINOv3 space. Furthermore, it achieves much better reliability scores and worst-case estimates, resulting in more reliable and robust detectors. However, the choice of latent space is an important consideration in SimLBR as DINOv2 does not achieve the same performance boost.
Figure 3: (a) Ablation of : We train SimLBR using ProGAN and different sampling distributions for . Always retaining at least half the information from the real image is one of the optimal and robust choices for sampling . (b) Ablation of MLP: We try different sizes of MLP. SimLBR performs better with smaller MLPs and overfits with large number of hidden layers.
| GenImage | AIGC | |||
| ID | OD | ID | OD | |
| w/o LBR | 94.37 | 77.70 | 85.58 | 73.26 |
| w/ LBR | 95.47 | 88.00 | 91.50 | 85.98 |
| Gain | 1.10 | 10.30 | 5.92 | 12.72 |
Table 6: Average accuracy on ID vs. OD testsets: We ablate the impact of using Latent Blending Regularization on In-Distribution (ID) and Out-Distribution (OD) generative testsets. ID testset contains generators that share architectural similarities with the training generator, whereas OD testset contains generators with substantially different architectures. We observe the most significant gains from LBR in the OD testset, reasserting that LBR encourages the model to learn a generator-agnostic decision boundary.
| Method | Original | JPEG Compression | Gaussian Blur | ||||||
|---|---|---|---|---|---|---|---|---|---|
| QF=95 | QF=90 | QF=75 | QF=50 | ||||||
| CNNSpot | 70.78 | 64.03 | 62.26 | 60.65 | 59.66 | 68.39 | 67.26 | 67.13 | 65.85 |
| FreDect | 64.03 | 66.95 | 67.45 | 66.64 | 65.33 | 65.75 | 66.48 | 68.58 | 69.64 |
| Fusing | 68.38 | 62.43 | 61.39 | 59.34 | 57.41 | 68.09 | 66.69 | 66.02 | 65.58 |
| LNP | 83.84 | 53.58 | 54.09 | 53.02 | 52.85 | 67.91 | 66.42 | 66.2 | 62.69 |
| LGrad | 75.34 | 51.55 | 51.39 | 50.00 | 50.00 | 71.73 | 69.12 | 68.43 | 66.22 |
Table 7: Robustness to JPEG Compression and Gaussian Blur: Following prior work, we evaluate the robustness of our model when different amounts of JPEG Compression and Gaussian Blur are applied to the input images. SimLBR is highly robust, showing minimal degradation even under strong image perturbations.
Figure 5: Comparison with OC-SVM: We train a One-Class SVM using ProGAN and SD v1.4 images and evaluate on AIGC and GenImage benchmarks, respectively. SimDLR clearly outperforms the outlier detector approach when using the same latent features.