RA-Det: Towards Universal Detection of AI-Generated Images via Robustness Asymmetry

Xinchang Wang; Yunhao Chen; Yuechen Zhang; Congcong Bian; Zihao Guo; Xingjun Ma; Hui Li

cs.CVMar 2, 2026

RA-Det: Towards Universal Detection of AI-Generated Images via Robustness Asymmetry

Authors: Xinchang Wang, Yunhao Chen, Yuechen Zhang, Congcong Bian, Zihao Guo, Xingjun Ma, Hui Li

Organizations: Jiangnan University · Fudan University

Abstract

Recent image generators produce photo-realistic content that undermines the reliability of downstream recognition systems. As visual appearance cues become less pronounced, appearance-driven detectors that rely on forensic cues or high-level representations lose stability. This motivates a shift from appearance to behavior, focusing on how images respond to controlled perturbations rather than how they look. In this work, we identify a simple and universal behavioral signal. Natural images preserve stable semantic representations under small, structured perturbations, whereas generated images exhibit markedly larger feature drift. We refer to this phenomenon as robustness asymmetry and provide a theoretical analysis that establishes a lower bound connecting this asymmetry to memorization tendencies in generative models, explaining its prevalence across architectures. Building on this insight, we introduce Robustness Asymmetry Detection (RA-Det), a behavior-driven detection framework that converts robustness asymmetry into a reliable decision signal. Evaluated across 14 diverse generative models and against more than 10 strong detectors, RA-Det achieves superior performance, improving the average performance by 7.81 percent. The method is data- and model-agnostic, requires no generator fingerprints, and transfers across unseen generators. Together, these results indicate that robustness asymmetry is a stable, general cue for synthetic-image detection and that carefully designed probing can turn this cue into a practical, universal detector. The source code is publicly available at Github.

Figures & tables

Figure 1: Robustness asymmetry between natural and synthetic images in embedding spaces (CLIP ( Radford et al., 2021 ) , DINO ( Siméoni et al., 2025 ) ). Under perturbation, show minimal embedding displacement, while synthetic images exhibit large representation drift (high displacement).

Figure 2: Backbone-agnostic evidence of robustness asymmetry. We measure embedding stability as the cosine similarity between features extracted from the clean image and its perturbed counterpart. Real images maintain higher similarity than synthetic images, and the separation remains consistent for both DINOv3 and CLIP.

Figure 3: Overview of RA-Det. The framework processes real and fake images through three key phases to identify generative content: (I) Differential Robustness Probing (DRP) generates targeted perturbations to amplify the robustness asymmetry between real and synthetic images. (II) The Multi-Branch Detector aggregates complementary forensic evidence by analyzing high-level semantic features, quantifying feature-space stability via the discrepancy branch, and capturing pixel-level artifacts through the low-level residual branch. (III) Contrastive Loss guides the training by enforcing a margin between the feature displacements of real and fake images.

Figure 4: Radar chart comparison of representative detectors across 16 generators. We compare GAN-specific detectors, including CNNSpot ( Wang et al., 2020 ) and LGrad ( Tan et al., 2023 ) ; diffusion-specific detectors, including DIRE-G and DIRE-D ( Wang et al., 2023 ) and DNF ( Zhang and Xu, 2025 ) ; and universal detectors, including UniFD ( Ojha et al., 2023 ) , NPR ( Tan et al., 2024 ) , RIGID ( He et al., 2024 ) , FerretNet ( Liang et al., 2026 ) , and RA-Det. Each subplot shows the per-generator accuracy of one detector, where a larger and more balanced radar profile indicates stronger cross-generator generalization.

Generator

GAN Detector

Diffusion Detector

Universal Detector

FreDect

LGrad

DIRE-G

DIRE-D

DNF

CNNSpot

GramNet

UniFD

NPR

RIGID

FerretNet

RA-Det (ours)

ProGAN

99.36/ 99.99

99.78/ 99.99

95.19/99.08

52.75/58.79

83.35/60.40

99.99 / 100.00

99.81/ 100.00

99.90/99.98

93.00/96.83

99.09/99.95

99.98 / 100.00

StyleGAN

78.02/88.98

89.63/98.03

83.03/91.74

51.31/56.68

71.76/44.18

85.71/ 99.54

83.59/94.49

80.40/97.48

96.06 / 99.78

71.19/70.61

94.53/98.63

94.98 /98.90

BigGAN

81.98/93.62

81.73/89.08

70.12/75.25

49.70/46.91

50.55/51.75

70.19/84.51

67.33/81.79

95.08 / 99.27

83.95/85.59

81.25/85.69

85.18/91.06

98.35 / 99.83

CycleGAN

78.77/84.78

86.94/95.01

74.19/80.56

49.58/50.03

47.77/66.49

85.20/93.48

86.07/95.33

98.33 / 99.80

95.19/98.12

75.34/83.04

93.64/98.34

96.52 / 99.47

StarGAN

94.62/ 99.49

99.27/ 100.00

95.47/99.34

46.72/40.64

98.55/86.44

91.62/98.15

95.05/99.23

95.75/99.37

97.17/ 100.00

71.34/77.64

99.97 / 100.00

99.92 / 100.00

Table 1: The detection performance comparison between our approach and baselines. We use ACC(%)/AP(%) as the evaluation metrics. DIRE-D denotes the DIRE detector trained over fake images from ADM, while DNF uses a model trained on ADM, similar to DIRE-D. DIRE-G denotes the DIRE detector trained over the same training set (ProGAN) as others. Among all detectors, the best result and the second-best result are denoted in boldface and underlined, respectively.

Setting	Training source	Acc (%)	AP (%)
Setting I	ProGAN	93.47	97.00
Setting II	SDv1.4	92.70	96.99
Setting III	ProGAN + SDv1.4	93.33	96.69

Table 2: Average performance under different training-source settings. Setting I, Setting II, and Setting III correspond to ProGAN-only, SDv1.4-only, and mixed ProGAN+SDv1.4 training, respectively.

Variant	Backbone	Loss	Acc (%)	AP (%)
Full model used in the main experiments
Full RA-Det (Ours)	DINOv3 ViT-L/16	$\mathbf{\mathcal{L}_{\mathrm{comp}}}$	93.47	97.00
Backbone / Objective
Backbone $\rightarrow$ CLIP	CLIP ViT-L/14	$\mathcal{L}_{\mathrm{comp}}$	91.85	95.00
Loss $\rightarrow$ BCE	DINOv3 ViT-L/16	$\mathcal{L}_{\mathrm{bce}}$	90.86	95.26
Probing strategy

Table 3: Ablation on backbone, training objective, probing strategy, contrastive margin, and the multi-branch detector in Sec. 3.2.3 . Sem/Dis/Res denote the semantic branch, discrepancy branch, and low-level residual branch, respectively. The full model used in our main experiments is reported at the top, with the best results shown in bold.

Figure 5: Performance comparison under common image perturbations. The plots show detector performance against (a) JPEG compression (QF = 95, 90 and 85) and (b) Gaussian blur (

\sigma

= 0.8, 1.0 and 1.5). The mean scores (diamonds) indicate that our method, RA-Det, maintains the highest accuracy and AP, demonstrating superior robustness.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Table 4: Per-generator performance of RA-Det under different training-source settings. Setting I, Setting II, and Setting III correspond to ProGAN-only, SDv1.4-only, and mixed ProGAN+SDv1.4 training, respectively. Generators are grouped into recent generative models and established benchmark generators.

Method	FLOPs (G)	Params (M)	Peak Mem. (MB)	Time (ms)
UniFD ( Ojha et al., 2023 )	103.79	202.05	1697.95	16.49
C2P-CLIP ( Tan et al., 2025 )	207.23	303.97	1835.00	21.64
RA-Det (Ours)	281.48	378.12	1962.00	25.14

Appendix

Table 5: Computational cost comparison with representative static detectors. All methods are evaluated under the same hardware environment and input resolution.

Encoder	Slope	Intercept	$R^{2}$
ViT-B/32	0.118	0.031	0.66
ViT-B/16	0.129	0.030	0.59
ViT-L/14	0.106	0.029	0.73
DINOv2-B/14	0.0241	0.045	0.64

Appendix

Table 6: Linear relation between AMS and small-

\varepsilon

discrepancy. For each diffusion checkpoint, we compute AMS following SIDE ( chen2026side ) and regress the small-

\varepsilon

discrepancy

\bar{\Delta}_{\mathrm{small}}

against AMS. Across all pretrained encoders, the fitted slope is positive, indicating that higher directly measured memorization is consistently associated with larger feature-shift discrepancy.

Panel of Figure 6 — Figure 6: Empirical validation of the lower bound. Left column: average differential shift $\text{Shift}_{\text{gen}}-\text{Shift}_{\text{real}}$ versus probe magnitude $\varepsilon$ , showing the predicted rise at small $\varepsilon$ and decline at larger $\varepsilon$ . Right column: average differential versus training epochs (used as a proxy for memorization since SIDE divergence is expensive to compute). Larger epoch counts correspond to stronger memorization and yield larger small– $\varepsilon$ differentials, in line with Theorem 4.3 .

AI-Generated Image Detection

AI-generated image detection identifies synthetic or AI-edited images and develops methods that generalize across generators, domains, and image transformations.

See all 194 papers

Dissect and Prune: Enhancing Robustness in AI-Generated Image Detection
Jun 9, 2026Dahye Kim, Jaehyun Choi, Hyun Seok Seong +4Image Corruption Robustness AI-Generated Image Detection
Korea AI Safety Institute (AISI), ETRI, Seongnam, South Korea · Department of Artificial Intelligence, Sungkyunkwan University, Suwon, South Korea
RAID: Towards Robust AI-Generated Image Detection with Bit-Reversed Images
Jul 31, 2026Renxi Cheng, Jie Gui, Hongsong WangImage Forgery Detection Digital Image Forensics
School of Cyber Science and Engineering, Southeast University, Nanjing 210096, China · Purple Mountain Laboratories, Nanjing 210000, China · Engineering Research Center of Blockchain Application, Supervision And Management (Southeast University), Ministry of Education, China +2
Where Detectors Fail: Probing Generative Space for Generalizable AI-Generated Image Detection
May 24, 2026Zijie Cao, Weijie Tu, Yao Xiao +3Synthetic Data Augmentation AI-Generated Image Detection
School of Computer Science and Engineering, Sun Yat-sen University, Guangzhou, China · Australian National University, Canberra, Australia · Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China +1

Jun 9, 2026J/K move · Enter open · S save

Dissect and Prune: Enhancing Robustness in AI-Generated Image Detection

Dahye Kim, Jaehyun Choi, Hyun Seok Seong, Seongho Kim+3

Korea AI Safety Institute (AISI), ETRI, Seongnam, South Korea · Department of Artificial Intelligence, Sungkyunkwan University, Suwon, South Korea

Image Corruption Robustness AI-Generated Image Detection

Open paper AskPDF arXiv

While existing AI-generated image detectors report high performance, we identify that this is largely driven by a critical prediction asymmetry: a bias toward the real class that severely limits sensitivity to generated content, especially under standard post-processing operations such as compression and resizing. We hypothesize that this stems from the model's reliance on spurious features, distracting signals that obscure true generative artifacts. To address this, we propose DEAR (Dissect and Prune), which leverages inpainted images to identify and prune these interfering components. Specifically, we find that features strongly aligned to either inpainted or non-inpainted regions are less robust to post-processing. By measuring the alignment between channel activations and inpaint masks, DEAR removes features at both extremes, retaining only those that capture genuine generative artifacts. Experimental results demonstrate that our approach significantly enhances robustness against unseen generators and post-processing, effectively mitigating the prediction asymmetry. Our code is available at https://github.com/dahyedahye/dear.

Abstract

AI-Generated Image Detection

Explore similar work

Dissect and Prune: Enhancing Robustness in AI-Generated Image Detection

RAID: Towards Robust AI-Generated Image Detection with Bit-Reversed Images

Where Detectors Fail: Probing Generative Space for Generalizable AI-Generated Image Detection