When Detectors Forget Forensics: Blocking Semantic Shortcuts for Generalizable AI-Generated Image Detection
Authors: Chao Shuai, Shaojing Fan, Chenlin Zou, Bin Gong, Weichen Lian, Xiuli Bi, Zhenguang Liu, Zhongjie Ba, Kui Ren
Organizations: State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China · National University of Singapore, Singapore · Chongqing University of Posts and Telecommunications, Chongqing, China
The growing realism of generative models has blurred the boundary between real and synthetic content, posing significant challenges to reliable AI-generated image detection. Although large-scale pre-trained Vision Foundation Models have advanced detection capability, their generalization to images from unseen generation pipelines remains inadequate. In this paper, we identify, for the first time, a key failure mechanism, termed semantic fallback, wherein forensic fine-tuning fails to fully reshape the representation space. Consequently, the resulting representations remain organized along high-level semantic structures rather than manipulation-specific forensic cues. Building on this insight, we propose a Geometric Semantic Decoupling (GSD) framework, which explicitly suppresses semantically dominant directions, thereby promoting invariant forensic representations. Specifically, GSD leverages a frozen CLIP encoder to estimate the dominant semantic subspace via Singular Value Decomposition (SVD). It then suppresses the semantic components through a geometry-constrained formulation with the suppression strength adaptively modulated across samples and layers. We further introduce a mini-batch SVD approximation strategy that amortizes subspace estimation, achieving over a 15× reduction in computational overhead while preserving effectiveness. Finally, considering practical scenarios spanning both large-scale and online evaluation, we develop three inference protocols, batch, per-sample, and reference-based inference, and demonstrate that they induce consistent semantic decoupling, yielding a stable forgery-oriented feature manifold.
Figures & tables
Fig. 1 : t-SNE [ 5 ] visualizations of feature representations extracted from the fine-tuned CLIP encoder and GSD-CLIP. The top row corresponds to the fine-tuned CLIP encoder, and the bottom row corresponds to GSD-CLIP. The three columns show results on the in-domain ProGAN [ 6 ] dataset and two cross-domain benchmarks, CelebDF-v2 [ 7 ] and DFDCP [ 8 ] . For each dataset, the left panel is colored by forgery labels (real vs. fake), while the right panel is colored by semantic labels. Compared with the fine-tuned CLIP encoder, which retains compact semantic clusters across both in-domain and cross-domain settings, GSD-CLIP substantially weakens identity- or content-driven semantic grouping and yields a representation space more aligned with fake/real discrimination.
Layer L
2
4
8
12
24
FaceForensics++
CLIPfz
0.153
0.102
0.153
0.145
0.333
CLIPft
0.152
0.110
0.142
0.136
0.317
Celeb-DF v2
CLIPfz
0.113
0.078
0.130
0.123
0.385
CLIPft
0.111
0.085
0.127
0.115
0.398
TABLE I : Distribution-level semantic similarity gap ΔS measured on CLS features from different layers of the frozen CLIP encoder ( CLIPfz ) and the fine-tuned CLIP encoder ( CLIPft ). A larger ΔS indicates a stronger identity-coupled semantic structure in the learned representation.
Fig. 2 : Semantic subspace occupancy of the fine-tuned CLIP on FaceForensics++, Celeb-DF v2, and DFDC. Across all datasets, wrongly classified samples exhibit consistently higher semantic subspace occupancy.
Dataset
λ=0
λ=0.2
λ=0.4
λ=0.6
λ=0.8
FaceForensics++ [ 18 ]
84.8
85.3
84.2
85.3
85.1
Celeb-DF v2 [ 7 ]
66.4
67.4
66.9
66.8
67.8
DFDC [ 51 ]
65.7
67.0
66.5
65.8
66.2
TABLE II : Cross-domain detection performance under different degrees of semantic removal. A linear probe is trained on features after partial semantic subtraction based on the frozen CLIP semantic basis. The results show that even simple semantic removal helps improve detection performance.
Fig. 3 : Overview of the proposed detection framework with Geometric Semantic Decoupling (GSD). During training, a trainable forensic branch and a frozen semantic anchor branch, both initialized from the same CLIP backbone, are processed in parallel. At selected transformer layers, the frozen branch estimates semantically dominant directions via Batch-SVD, and the GSD module adaptively suppresses the corresponding components in the trainable features to produce semantically decoupled representations.
Setting
SVD Time (ms)
Ratio (%)
Speedup
Training (per image)
Batch-SVD
5.43±0.02
32.72±0.09
∼ 15.6 ×
Single-SVD
84.81±0.02
88.42±0.07
1 ×
Inference (per image)
Batch-SVD
3.37±0.02
50.45±0.05
∼ 15.2 ×
Single-SVD
51.13±0.03
93.90±0.06
1 ×
TABLE III : Per-image runtime comparison of Batch-SVD and Single-SVD. The ratio denotes the percentage of total computation time spent on SVD operations. Batch-SVD significantly reduces the per-image cost compared with Single-SVD for both training and inference.
Fig. 4 : During inference, the trained detector can be deployed with three strategies: Batch Inference for efficient dataset-level evaluation, Per-sample Inference for online image-level detection with sample-specific semantic estimation, and Reference-based Inference for a more efficient approximation based on a semantic reference set.
TABLE IV : Summary of datasets and evaluation protocols used in this work.
Methods
Video-level AUC
Methods
Frame-level AUC
CDv2
CDv1
DFDC
DFDCP
DFD
Avg.
CDv2
CDv1
DFDC
DFDCP
DFD
Avg.
F3Net (ECCV’20)
78.9
–
71.8
74.9
84.4
77.5
Efficient-b4† (ICML’19)
74.9
70.5
69.6
72.8
81.5
73.9
CLIP† (ICML’21)
88.4
89.6
83.3
86.3
92.6
88.0
CLIP† (ICML’21)
83.2
86.1
80.7
82.4
87.7
84.0
LaV (MM’23)
92.2
84.7
82.0
89.7
96.8
89.1
Face X-Ray (CVPR’20)
67.9
70.9
63.3
69.4
76.7
69.6
IID (CVPR’23)
83.8
–
70.0
68.9
93.9
79.2
RECCE (CVPR’22)
73.2
–
71.3
74.2
74.2
73.2
CFM (TIFS’23)
89.7
–
70.6
80.2
95.2
83.9
UCF† (ICCV’23)
82.4
77.9
80.5
75.9
87.8
80.9
TABLE V : Our method outperforms existing methods on five cross-domain datasets. “–” indicates that the results are not reported in the original paper, and † indicates that the results are obtained by using the official pre-trained model or reproduction, and some results are cited from [ 9 , 10 ] . Top results are highlighted in bold .
Methods
Video-level AUC
Methods
Frame-level AUC
UniFace
e4s
FaceDancer
FSGAN
InSwap
SimSwap
Avg.
UniFace
e4s
FaceDancer
FSGAN
InSwap
SimSwap
Avg.
CLIP (ICML’21)
91.0
91.6
89.8
96.0
88.5
80.3
89.5
CLIP (ICML’21)
86.5
87.8
85.6
92.0
83.9
76.3
85.4
RECCE (CVPR’22)
89.8
68.3
84.8
94.9
84.8
76.8
83.2
RECCE (CVPR’22)
84.2
65.2
78.3
88.4
79.5
73.0
78.1
SBI (CVPR’22)
72.4
75.0
59.4
80.3
71.2
70.1
71.4
IID (CVPR’23)
79.5
71.0
79.0
86.4
74.4
64.0
75.7
UCF (ICCV’23)
83.1
73.1
86.2
93.7
80.9
64.7
80.3
SBI (CVPR’22)
64.4
69.0
44.7
87.9
63.3
56.8
64.4
IID (CVPR’23)
83.9
76.6
84.4
92.7
78.9
64.4
80.2
UCF (ICCV’23)
78.7
69.2
80.0
88.1
76.8
64.9
76.3
TABLE VI : Our method achieves superior results on unseen manipulation methods. Results are reported on six representative face-swapping methods selected from DF40, where all samples are generated based on the FF++ domain.
Methods
GAN
Deep fakes
Low level
Perceptual loss
Guided
LDM
Glide
Dalle
Avg.
Pro- GAN
Cycle- GAN
Big- GAN
Style- GAN
Gau- GAN
Star- GAN
SITD
SAN
CRN
IMLE
200 steps
200 w/cfg
100 steps
100 27
50 27
100 10
CNN-Spot (CVPR’20)
100.0
85.2
70.2
85.7
79.0
91.7
53.5
66.7
48.7
86.3
86.3
60.1
54.0
55.0
54.1
60.8
63.8
65.7
55.6
69.6
Patchfor (ECCV’20)
75.0
69.0
68.5
79.2
64.2
63.9
75.5
75.1
75.3
72.3
55.3
67.4
76.5
76.1
75.8
74.8
73.3
68.5
67.9
71.2
Co-occurence (ArXiv’20)
97.7
63.1
53.8
92.5
51.1
54.7
57.1
63.1
55.9
65.7
65.8
60.5
70.7
70.5
71.0
70.2
69.6
69.9
67.5
66.9
Freq-spec (WIFS’20)
49.9
99.9
50.5
49.9
50.3
99.7
50.1
50.0
48.0
50.6
50.1
50.9
50.4
50.4
50.3
51.7
51.4
50.4
50.0
55.5
F3Net (ECCV’20)
99.4
76.4
65.3
92.6
58.1
100.0
63.5
54.2
47.3
51.5
51.5
69.2
68.2
75.3
68.8
81.7
83.2
83.0
66.3
71.3
TABLE VII : ACC (%) performance on the UniversalFakeDetect dataset. Following [ 39 ] , ProGAN is used for training, and selected results are cited from [ 9 ] . Our method achieves the best average performance and demonstrates competitive or superior results across most generative categories.
Methods
Midjourney
SDv1.4
SDv1.5
ADM
GLIDE
Wukong
VQDM
BigGAN
Avg.
ResNet-50 (CVPR’16)
54.9
99.9
99.7
53.5
61.9
98.2
56.6
52.0
72.1
DeiT-S (ICML’21)
55.6
99.9
99.8
49.8
58.1
98.9
56.9
53.5
71.6
Swin-T (ICCV’21)
62.1
99.9
99.8
49.8
67.6
99.1
62.3
57.6
74.8
CNNSpot (CVPR’20)
52.8
96.3
95.9
50.1
39.8
78.6
53.4
46.8
64.2
Freq-spec (WIFS’20)
52.0
99.4
99.2
49.7
49.8
94.8
55.6
49.8
68.8
F3Net (ECCV’20)
50.1
99.9
99.9
49.9
50.0
99.9
49.9
49.9
68.7
TABLE VIII : ACC (%) performance on the GenImage dataset. Our method achieves the best average ACC while maintaining balanced performance across diverse generative categories.
Infer
Ref. Dataset
Metric
CD2
DFDC
e4s
FaceDancer
Avg.all
Single-SVD Training for Face Forgery
P-Infer
–
ACC
83.0
77.2
93.7
87.3
86.0
P-Infer
–
AUC
90.4
86.2
98.1
94.1
92.8
Batch-SVD Training for Face Forgery
P-Infer
–
ACC
82.7
76.4
93.1
87.0
85.6
P-Infer
–
AUC
90.4
85.5
97.9
93.9
92.4
TABLE IX : Comparison of different training and inference protocols for face forgery detection. We report ACC and frame-level AUC (%) on 11 test datasets.
Infer
Metric
CycleGAN
Apple
horse
Orange
Summer
Avg.all
R-Infer
ACC
99.6
99.8
99.4
99.3
99.4
B-Infer
ACC
99.6
99.7
99.4
99.3
99.4
Infer
Metric
ProGAN
Airplane
Bicycle
Car
Dog
Avg.all
R-Infer
ACC
100.0
100.0
100.0
100.0
100.0
TABLE X : Comparison of different inference protocols for the natural-image setting. ACC (%) is reported on category-specific images generated by CycleGAN and ProGAN.
Fig. 5 : (a) The semantic variance is highly concentrated in the first few principal components, particularly the first and second ones, while the remaining components contribute only marginally. (b) We compare six insertion strategies and report ACC (%) on the testing datasets.
λ
CDv2
DFDCP
DFDC
e4s
InSwap
Avg.
0.05
81.2
80.9
76.3
92.6
84.0
83.0
0.1
81.4
80.8
76.6
92.7
84.5
83.2
0.2
81.7
81.3
77.0
93.5
85.0
83.7
0.4
82.3
82.0
76.7
93.2
84.5
83.7
0.6
82.8
82.2
76.9
93.1
84.7
83.9
0.8
82.8
82.3
76.8
93.2
84.6
83.9
TABLE XI : Comparison under different subtraction strategies. We report ACC (%) on the testing datasets.
k
CDv2
DFD
DFDC
SimSwap
UniFace
Avg.
1
89.8
94.0
85.9
91.4
95.9
91.4
2
90.2
94.0
85.5
91.3
95.9
91.4
8
90.5
94.4
85.9
91.2
96.3
91.7
16
90.4
94.4
85.7
91.0
96.4
91.6
32
90.5
94.4
85.6
91.0
96.4
91.6
64
90.6
94.5
85.8
91.1
96.3
91.7
TABLE XII : Effect of the subspace dimension k on the testing datasets. Frame-level AUC (%) is reported.
Fig. 6 : Visualization of different initialization settings for λ and the corresponding results (ACC, %) on the test datasets.
Batchsize
CDv1
DFD
DFDC
FaceDancer
FSGAN
Avg.
Different Training Batch Sizes (Test batch size ×4 )
Btr=16
90.6
94.4
85.0
93.6
96.3
92.0
Btr=32
90.5
94.2
85.1
93.7
96.4
92.0
Btr=64
90.9
94.1
86.1
93.6
96.4
92.2
Btr=128
91.3
94.5
85.8
93.8
96.1
92.3
Different Inference Batch Sizes (Training Batch Size = 128)
TABLE XIII : Effect of training and inference batch sizes on frame-level AUC (%) over the testing datasets.
Method
CDv2
DFDCP
DFDC
InSwap
FaceDancer
Avg.
BLIP
83.3
81.5
76.9
87.5
81.0
82.0
+Ours
87.4 +4.1
84.9 +3.4
80.3 +3.4
91.2 +3.7
85.7 +4.7
85.9 +3.9
SigLIP
88.0
86.3
78.7
85.8
82.5
84.3
+Ours
91.3 +3.3
89.4 +3.1
81.0 +2.3
93.1 +7.3
89.9 +7.4
88.9 +4.7
CLIP
90.7
88.4
83.1
90.3
91.5
88.8
+Ours
96.4 +5.7
93.2 +4.8
88.6 +5.5
96.5 +6.2
97.5 +6.0
94.4 +5.6
TABLE XIV : Ablation studies (video-level AUC%) on different vision foundation models (VFMs).
Fig. 7 : Robustness analysis against common image corruptions. The curves illustrate the Video-level AUC (%) performance of our method versus existing approaches. We test across five different degradation scenarios, including Color Saturation, JPEG Compression, Color Contrast, Block-wise noise, and Gaussian Blur, plotted against increasing severity levels (0-5).
Fig. 8 : Feature visualization of different GSD inference strategies. We visualize the 3D t-SNE feature distributions under three deployment protocols, including Per-sample Inference, Batch Inference, and Reference-based Inference. The top row shows the semantic components preserved by the frozen semantic anchor, while the bottom row shows the semantically decoupled forgery features after GSD. Notably, across the three inference strategies, the semantic components exhibit highly similar feature spaces, while the semantically decoupled forgery features are mapped into an almost consistent forgery-oriented feature space.
Fig. 9 : t-SNE [ 5 ] visualization of feature distributions extracted by the naively finetuned CLIP (a, b, c) and GSD-CLIP (d, e, f, g, h, i) on cross-domain datasets. Points are colored by forgery labels and semantic labels.
AI-generated image detection identifies synthetic or AI-edited images and develops methods that generalize across generators, domains, and image transformations.
Detecting AI-generated images across unseen architectures remains challenging, as existing models often overfit to generator-specific fingerprints and semantic content rather than learning universal forgery traces. We attribute this failure to feature entanglement: detectors learn these factors as a single entangled representation, where universal forgery traces are inextricably confounded with both generator-specific fingerprints and semantic content. Crucially, our spectral analysis reveals that this entanglement is avoidable: distinct generator-specific fingerprints (e.g., GAN stripes vs. Diffusion Model spots) occupy disjoint frequency subspaces and coexist as independent superpositions. Leveraging this physical orthogonality, we propose the Orthogonal Decomposition and Purification Network (ODP-Net) to structurally disentangle these factors. Specifically, ODP-Net employs (1) Instance-aware Orthogonal Decomposition to project features into mutually exclusive subspaces: universal forgery traces, generator-specific fingerprints, and semantic content; (2) Perturbation-based Purification to enforce semantic invariance via cross-sample feature injection; and (3) Manifold Alignment to bridge domain gaps. By explicitly decoupling universal forgery traces from generator-specific fingerprints and semantic content, ODP-Net achieves state-of-the-art performance on unseen architectures (e.g., Stable Diffusion 3), validating that structural disentanglement is key to generalization.
Zhiyuan Wang, Yanxiang Chen, Pengcheng Zhao +2
Hefei University of Technology · Key Laboratory of Knowledge Engineering with Big Data · Key Laboratory of Knowledge Engineering with Big Data (Hefei University of Technology), Ministry of Education; School of Computer Science and Information Engineering, Hefei University of Technology; and Intelligent Interconnected Systems Laboratory of Anhui Province (Hefei University of Technology) +3
The rapid progress of generative models, such as GANs and diffusion models, has facilitated the creation of highly realistic images, raising growing concerns over their misuse in security-sensitive domains. While existing detectors perform well under known generative settings, they often fail to generalize to unknown generative models, especially when semantic content between real and fake images is closely aligned. In this paper, we revisit the use of CLIP features for AI-generated image detection and uncover a critical limitation: the high-level semantic information embedded in CLIP's visual features hinders effective discrimination. To address this, we propose the NS-Net, a novel detection framework that leverages NULL-Space projection to decouple semantic information from CLIP's visual features, followed by contrastive learning to capture intrinsic distributional differences between real and generated images. Furthermore, we design a Patch Selection strategy to preserve fine-grained artifacts by selecting patches with the highest and lowest spectral entropy. Extensive experiments on an open-world benchmark comprising images generated by 47 diverse generative models show that NS-Net outperforms existing state-of-the-art methods, achieving a 5.0% improvement in detection accuracy, thereby demonstrating strong generalization across both GAN- and diffusion-based image generation techniques. Our code is available at https://github.com/HorizonTEL/NS-Net.
Jiazhen Yan, Fan Wang, Ziwen He +2
Engineering Research Center of Digital Forensics, Ministry of Education, Nanjing University of Information Science and Technology, Nanjing, 210044, China. · University of Macau, Macau, 999078, China.
The rapid advancement of AI-generated content has made the reliable detection of generated images an increasingly critical challenge. Existing detection methods are often dominated during training by semantically salient components with high signal-to-noise ratios (SNRs), thereby suppressing subtler forensic cues associated with the underlying generation mechanisms and embedded in low-level statistical structures. From an information-theoretic perspective, we present a key insight: effective detection in the low-level statistical space requires mitigating the dominance of semantic components while emphasizing and amplifying responses to low-SNR forgery traces. Building on this insight, we propose RippleNet, an AI-generated image detection framework based on local differential signals. RippleNet adaptively identifies forgery-sensitive regions and constructs multi-directional, multi-scale differential representations within local neighborhoods, explicitly characterizing anomalous patterns in neighborhood statistics. More importantly, we refine the attention mechanism to operate within the local differential representation space, enabling the model to establish explicit dependencies at a finer statistical granularity. This design facilitates the capture of pixel-level forgery traces that are difficult to model using conventional convolutions or image-wide patch-level attention. Extensive experiments on multiple public benchmarks and under cross-generator evaluation settings demonstrate that RippleNet achieves consistently competitive performance.
Jiazhen Yang, Ruijin Jin, Junjun Zheng +3
Zhejiang University · Taobao & Tmall Group of Alibaba · Zhejiang University of Technology