cs.CVMar 2, 2026

RA-Det: Towards Universal Detection of AI-Generated Images via Robustness Asymmetry

Authors: Xinchang Wang, Yunhao Chen, Yuechen Zhang, Congcong Bian, Zihao Guo, Xingjun Ma, Hui Li

Organizations: Jiangnan University · Fudan University

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Recent image generators produce photo-realistic content that undermines the reliability of downstream recognition systems. As visual appearance cues become less pronounced, appearance-driven detectors that rely on forensic cues or high-level representations lose stability. This motivates a shift from appearance to behavior, focusing on how images respond to controlled perturbations rather than how they look. In this work, we identify a simple and universal behavioral signal. Natural images preserve stable semantic representations under small, structured perturbations, whereas generated images exhibit markedly larger feature drift. We refer to this phenomenon as robustness asymmetry and provide a theoretical analysis that establishes a lower bound connecting this asymmetry to memorization tendencies in generative models, explaining its prevalence across architectures. Building on this insight, we introduce Robustness Asymmetry Detection (RA-Det), a behavior-driven detection framework that converts robustness asymmetry into a reliable decision signal. Evaluated across 14 diverse generative models and against more than 10 strong detectors, RA-Det achieves superior performance, improving the average performance by 7.81 percent. The method is data- and model-agnostic, requires no generator fingerprints, and transfers across unseen generators. Together, these results indicate that robustness asymmetry is a stable, general cue for synthetic-image detection and that carefully designed probing can turn this cue into a practical, universal detector. The source code is publicly available at Github.

Figures & tables

Figure 1: Robustness asymmetry between natural and synthetic images in embedding spaces (CLIP ( Radford et al., 2021 ) , DINO ( Siméoni et al., 2025 ) ). Under perturbation, show minimal embedding displacement, while synthetic images exhibit large representation drift (high displacement).
Figure 2: Backbone-agnostic evidence of robustness asymmetry. We measure embedding stability as the cosine similarity between features extracted from the clean image and its perturbed counterpart. Real images maintain higher similarity than synthetic images, and the separation remains consistent for both DINOv3 and CLIP.
Figure 3: Overview of RA-Det. The framework processes real and fake images through three key phases to identify generative content: (I) Differential Robustness Probing (DRP) generates targeted perturbations to amplify the robustness asymmetry between real and synthetic images. (II) The Multi-Branch Detector aggregates complementary forensic evidence by analyzing high-level semantic features, quantifying feature-space stability via the discrepancy branch, and capturing pixel-level artifacts through the low-level residual branch. (III) Contrastive Loss guides the training by enforcing a margin between the feature displacements of real and fake images.
Figure 4: Radar chart comparison of representative detectors across 16 generators. We compare GAN-specific detectors, including CNNSpot ( Wang et al., 2020 ) and LGrad ( Tan et al., 2023 ) ; diffusion-specific detectors, including DIRE-G and DIRE-D ( Wang et al., 2023 ) and DNF ( Zhang and Xu, 2025 ) ; and universal detectors, including UniFD ( Ojha et al., 2023 ) , NPR ( Tan et al., 2024 ) , RIGID ( He et al., 2024 ) , FerretNet ( Liang et al., 2026 ) , and RA-Det. Each subplot shows the per-generator accuracy of one detector, where a larger and more balanced radar profile indicates stronger cross-generator generalization.
GeneratorGAN DetectorDiffusion DetectorUniversal Detector 
FreDectLGradDIRE-GDIRE-DDNFCNNSpotGramNetUniFDNPRRIGIDFerretNetRA-Det (ours)
ProGAN99.36/ 99.9999.78/ 99.9995.19/99.0852.75/58.7983.35/60.4099.99 / 100.0099.99 / 100.0099.81/ 100.0099.90/99.9893.00/96.8399.09/99.9599.98 / 100.00
StyleGAN78.02/88.9889.63/98.0383.03/91.7451.31/56.6871.76/44.1885.71/ 99.5483.59/94.4980.40/97.4896.06 / 99.7871.19/70.6194.53/98.6394.98 /98.90
BigGAN81.98/93.6281.73/89.0870.12/75.2549.70/46.9150.55/51.7570.19/84.5167.33/81.7995.08 / 99.2783.95/85.5981.25/85.6985.18/91.0698.35 / 99.83
CycleGAN78.77/84.7886.94/95.0174.19/80.5649.58/50.0347.77/66.4985.20/93.4886.07/95.3398.33 / 99.8095.19/98.1275.34/83.0493.64/98.3496.52 / 99.47
StarGAN94.62/ 99.4999.27/ 100.0095.47/99.3446.72/40.6498.55/86.4491.62/98.1595.05/99.2395.75/99.3797.17/ 100.0071.34/77.6499.97 / 100.0099.92 / 100.00
Table 1: The detection performance comparison between our approach and baselines. We use ACC(%)/AP(%) as the evaluation metrics. DIRE-D denotes the DIRE detector trained over fake images from ADM, while DNF uses a model trained on ADM, similar to DIRE-D. DIRE-G denotes the DIRE detector trained over the same training set (ProGAN) as others. Among all detectors, the best result and the second-best result are denoted in boldface and underlined, respectively.
SettingTraining sourceAcc (%)AP (%)
Setting IProGAN93.4797.00
Setting IISDv1.492.7096.99
Setting IIIProGAN + SDv1.493.3396.69
Table 2: Average performance under different training-source settings. Setting I, Setting II, and Setting III correspond to ProGAN-only, SDv1.4-only, and mixed ProGAN+SDv1.4 training, respectively.
VariantBackboneLossAcc (%)AP (%)
Full model used in the main experiments
Full RA-Det (Ours)DINOv3 ViT-L/16Lcomp\mathbf{\mathcal{L}_{\mathrm{comp}}}93.4797.00
Backbone / Objective
Backbone →\rightarrow CLIPCLIP ViT-L/14Lcomp\mathcal{L}_{\mathrm{comp}}91.8595.00
Loss →\rightarrow BCEDINOv3 ViT-L/16Lbce\mathcal{L}_{\mathrm{bce}}90.8695.26
Probing strategy
Table 3: Ablation on backbone, training objective, probing strategy, contrastive margin, and the multi-branch detector in Sec. 3.2.3 . Sem/Dis/Res denote the semantic branch, discrepancy branch, and low-level residual branch, respectively. The full model used in our main experiments is reported at the top, with the best results shown in bold.
Figure 5: Performance comparison under common image perturbations. The plots show detector performance against (a) JPEG compression (QF = 95, 90 and 85) and (b) Gaussian blur ( σ\sigma = 0.8, 1.0 and 1.5). The mean scores (diamonds) indicate that our method, RA-Det, maintains the highest accuracy and AP, demonstrating superior robustness.
Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Table 4: Per-generator performance of RA-Det under different training-source settings. Setting I, Setting II, and Setting III correspond to ProGAN-only, SDv1.4-only, and mixed ProGAN+SDv1.4 training, respectively. Generators are grouped into recent generative models and established benchmark generators.
MethodFLOPs (G)Params (M)Peak Mem. (MB)Time (ms)
UniFD ( Ojha et al., 2023 )103.79202.051697.9516.49
C2P-CLIP ( Tan et al., 2025 )207.23303.971835.0021.64
RA-Det (Ours)281.48378.121962.0025.14
Appendix
Table 5: Computational cost comparison with representative static detectors. All methods are evaluated under the same hardware environment and input resolution.
EncoderSlopeInterceptR2R^{2}
ViT-B/320.1180.0310.66
ViT-B/160.1290.0300.59
ViT-L/140.1060.0290.73
DINOv2-B/140.02410.0450.64
Appendix
Table 6: Linear relation between AMS and small- ε\varepsilon discrepancy. For each diffusion checkpoint, we compute AMS following SIDE ( chen2026side ) and regress the small- ε\varepsilon discrepancy Δˉsmall\bar{\Delta}_{\mathrm{small}} against AMS. Across all pretrained encoders, the fitted slope is positive, indicating that higher directly measured memorization is consistently associated with larger feature-shift discrepancy.
Figure 6: Empirical validation of the lower bound. Left column: average differential shift Shiftgen−Shiftreal\text{Shift}_{\text{gen}}-\text{Shift}_{\text{real}} versus probe magnitude ε\varepsilon , showing the predicted rise at small ε\varepsilon and decline at larger ε\varepsilon . Right column: average differential versus training epochs (used as a proxy for memorization since SIDE divergence is expensive to compute). Larger epoch counts correspond to stronger memorization and yield larger small– ε\varepsilon differentials, in line with Theorem 4.3 .
More in this topic

AI-Generated Image Detection

AI-generated image detection identifies synthetic or AI-edited images and develops methods that generalize across generators, domains, and image transformations.

See all 194 papers

Explore similar work

CardsList
Jun 9, 2026

Dissect and Prune: Enhancing Robustness in AI-Generated Image Detection

While existing AI-generated image detectors report high performance, we identify that this is largely driven by a critical prediction asymmetry: a bias toward the real class that severely limits sensitivity to generated content, especially under standard post-processing operations such as compression and resizing. We hypothesize that this stems from the model's reliance on spurious features, distracting signals that obscure true generative artifacts. To address this, we propose DEAR (Dissect and Prune), which leverages inpainted images to identify and prune these interfering components. Specifically, we find that features strongly aligned to either inpainted or non-inpainted regions are less robust to post-processing. By measuring the alignment between channel activations and inpaint masks, DEAR removes features at both extremes, retaining only those that capture genuine generative artifacts. Experimental results demonstrate that our approach significantly enhances robustness against unseen generators and post-processing, effectively mitigating the prediction asymmetry. Our code is available at https://github.com/dahyedahye/dear.

Dahye Kim, Jaehyun Choi, Hyun Seok Seong +4

Korea AI Safety Institute (AISI), ETRI, Seongnam, South Korea · Department of Artificial Intelligence, Sungkyunkwan University, Suwon, South Korea

Image Corruption RobustnessAI-Generated Image Detection
AskPDF
Jul 31, 2026

RAID: Towards Robust AI-Generated Image Detection with Bit-Reversed Images

The rapid advancement of image generation models has made it increasingly difficult for people to distinguish AI-generated images from real ones. To prevent the potential risks associated with the misuse of fake images, AI-generated image detection has gained significant attention. Existing methods neglect the inherent differences between real and fake images, thus lacking robustness and generalization ability. In this work, we innovatively investigate AI-generated image detection using bit-planes, and introduce the bit-reversed image. We propose a simple yet effective pipeline consisting of construction of bit-reversed images, gradient-based patch selection and a convolutional classifier. Besides, we provide a theoretical analysis from the mathematical perspective to demonstrate the validity of our approach. We also introduce two challenging datasets for AI-generated image detection. Extensive experiments verify the effectiveness of our approach across different settings, including cross-generator generalization, cross-dataset generalization and zero-shot performance. Without bells and whistles, our approach outperforms existing methods on over 40 benchmarks, and is nearly 100 times faster than counterparts. The code is at https://github.com/renxi-seu/RAID.

Renxi Cheng, Jie Gui, Hongsong Wang

School of Cyber Science and Engineering, Southeast University, Nanjing 210096, China · Purple Mountain Laboratories, Nanjing 210000, China · Engineering Research Center of Blockchain Application, Supervision And Management (Southeast University), Ministry of Education, China +2

Image Forgery DetectionDigital Image ForensicsAI-Generated Image Detection
AskPDF
May 24, 2026

Where Detectors Fail: Probing Generative Space for Generalizable AI-Generated Image Detection

Detecting AI-generated images (AIGI) remains challenging because detectors often fail to generalize to unseen generators. Although existing methods are trained on large datasets, their performance still degrades when generation settings change, indicating that data scale alone is insufficient and that limited coverage of generative variations during training is a key factor. Studies on generative model editing show that small changes in internal representations can produce diverse and meaningful image variations, many of which are not explored under standard sampling. Leveraging this insight, we propose PROBE (Probing Robustness via Boundary Exploration), a framework that improves detector generalization by actively exploring challenging regions of the generative process. Instead of treating the generator as a fixed data source, PROBE uses the detector as a critic to steer the generator through manifold-level modifications, producing realistic samples that are difficult to classify. These samples expose failure cases that are uncommon under standard data sampling strategies and are used to refine the detector. Experimental results across multiple benchmarks indicate that PROBE enhances generalization to unseen generators, resulting in more generalizable AIGI detection performance. Code and models are available at https://github.com/Amamiya-C/PROBE-AIGI-Detection

Zijie Cao, Weijie Tu, Yao Xiao +3

School of Computer Science and Engineering, Sun Yat-sen University, Guangzhou, China · Australian National University, Canberra, Australia · Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China +1

Synthetic Data AugmentationAI-Generated Image Detection
AskPDF