When Detectors Forget Forensics: Blocking Semantic Shortcuts for Generalizable AI-Generated Image Detection

Chao Shuai; Shaojing Fan; Chenlin Zou; Bin Gong; Weichen Lian; Xiuli Bi; Zhenguang Liu; Zhongjie Ba

cs.CVMar 10, 2026

When Detectors Forget Forensics: Blocking Semantic Shortcuts for Generalizable AI-Generated Image Detection

Authors: Chao Shuai, Shaojing Fan, Chenlin Zou, Bin Gong, Weichen Lian, Xiuli Bi, Zhenguang Liu, Zhongjie Ba,

Organizations: State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China · National University of Singapore, Singapore · Chongqing University of Posts and Telecommunications, Chongqing, China

Abstract

The growing realism of generative models has blurred the boundary between real and synthetic content, posing significant challenges to reliable AI-generated image detection. Although large-scale pre-trained Vision Foundation Models have advanced detection capability, their generalization to images from unseen generation pipelines remains inadequate. In this paper, we identify, for the first time, a key failure mechanism, termed semantic fallback, wherein forensic fine-tuning fails to fully reshape the representation space. Consequently, the resulting representations remain organized along high-level semantic structures rather than manipulation-specific forensic cues. Building on this insight, we propose a Geometric Semantic Decoupling (GSD) framework, which explicitly suppresses semantically dominant directions, thereby promoting invariant forensic representations. Specifically, GSD leverages a frozen CLIP encoder to estimate the dominant semantic subspace via Singular Value Decomposition (SVD). It then suppresses the semantic components through a geometry-constrained formulation with the suppression strength adaptively modulated across samples and layers. We further introduce a mini-batch SVD approximation strategy that amortizes subspace estimation, achieving over a $15 \times$ reduction in computational overhead while preserving effectiveness. Finally, considering practical scenarios spanning both large-scale and online evaluation, we develop three inference protocols, batch, per-sample, and reference-based inference, and demonstrate that they induce consistent semantic decoupling, yielding a stable forgery-oriented feature manifold.

Figures & tables

Fig. 1 : t-SNE [ 5 ] visualizations of feature representations extracted from the fine-tuned CLIP encoder and GSD-CLIP. The top row corresponds to the fine-tuned CLIP encoder, and the bottom row corresponds to GSD-CLIP. The three columns show results on the in-domain ProGAN [ 6 ] dataset and two cross-domain benchmarks, CelebDF-v2 [ 7 ] and DFDCP [ 8 ] . For each dataset, the left panel is colored by forgery labels (real vs. fake), while the right panel is colored by semantic labels. Compared with the fine-tuned CLIP encoder, which retains compact semantic clusters across both in-domain and cross-domain settings, GSD-CLIP substantially weakens identity- or content-driven semantic grouping and yields a representation space more aligned with fake/real discrimination.

Layer L	2	4	8	12	24
FaceForensics++
$CLIP_{fz}$	0.153	0.102	0.153	0.145	0.333
$CLIP_{ft}$	0.152	0.110	0.142	0.136	0.317
Celeb-DF v2
$CLIP_{fz}$	0.113	0.078	0.130	0.123	0.385
$CLIP_{ft}$	0.111	0.085	0.127	0.115	0.398

TABLE I : Distribution-level semantic similarity gap

\Delta S

measured on CLS features from different layers of the frozen CLIP encoder (

CLIP_{fz}

) and the fine-tuned CLIP encoder (

CLIP_{ft}

). A larger

\Delta S

indicates a stronger identity-coupled semantic structure in the learned representation.

Fig. 2 : Semantic subspace occupancy of the fine-tuned CLIP on FaceForensics++, Celeb-DF v2, and DFDC. Across all datasets, wrongly classified samples exhibit consistently higher semantic subspace occupancy.

Dataset	$\lambda=0$	$\lambda=0.2$	$\lambda=0.4$	$\lambda=0.6$	$\lambda=0.8$
FaceForensics++ [ 18 ]	84.8	85.3	84.2	85.3	85.1
Celeb-DF v2 [ 7 ]	66.4	67.4	66.9	66.8	67.8
DFDC [ 51 ]	65.7	67.0	66.5	65.8	66.2

TABLE II : Cross-domain detection performance under different degrees of semantic removal. A linear probe is trained on features after partial semantic subtraction based on the frozen CLIP semantic basis. The results show that even simple semantic removal helps improve detection performance.

Fig. 3 : Overview of the proposed detection framework with Geometric Semantic Decoupling (GSD). During training, a trainable forensic branch and a frozen semantic anchor branch, both initialized from the same CLIP backbone, are processed in parallel. At selected transformer layers, the frozen branch estimates semantically dominant directions via Batch-SVD, and the GSD module adaptively suppresses the corresponding components in the trainable features to produce semantically decoupled representations.

Training (per image)
Setting	SVD Time (ms)	Ratio (%)	Speedup
Batch-SVD	$5.43\pm 0.02$	$32.72\pm 0.09$	$\sim$ 15.6 $\times$
Single-SVD	$84.81\pm 0.02$	$88.42\pm 0.07$	1 $\times$
Inference (per image)
Batch-SVD	$3.37\pm 0.02$	$50.45\pm 0.05$	$\sim$ 15.2 $\times$
Single-SVD	$51.13\pm 0.03$	$93.90\pm 0.06$	1 $\times$

TABLE III : Per-image runtime comparison of Batch-SVD and Single-SVD. The

ratio

denotes the percentage of total computation time spent on SVD operations. Batch-SVD significantly reduces the per-image cost compared with Single-SVD for both training and inference.

Fig. 4 : During inference, the trained detector can be deployed with three strategies: Batch Inference for efficient dataset-level evaluation, Per-sample Inference for online image-level detection with sample-specific semantic estimation, and Reference-based Inference for a more efficient approximation based on a semantic reference set.

Regime	Protocol	Training Set	Test Set(s)
Face forgery detection	Cross-dataset generalization	FF++ (c23)	Celeb-DF-v1 (CD1), Celeb-DF-v2 (CD2), DFD, DFDC, DFDCP
Face forgery detection	Cross-manipulation generalization	FF++ (c23)	DF40: UniFace, e4s, FaceDancer, FSGAN, InSwap, SimSwap
Synthetic image detection	Cross-generator generalization	ProGAN	UniversalFakeDetect: 19 unseen test sets (GANs/Diffusions/Deepfakes)
Synthetic image detection	Cross-generator generalization	SD v1.4	GenImage: Midjourney, SD v1.5, ADM, GLIDE, Wukong, VQDM, BigGAN

TABLE IV : Summary of datasets and evaluation protocols used in this work.

Methods	Video-level AUC						Methods	Frame-level AUC
Methods	CDv2	CDv1	DFDC	DFDCP	DFD	Avg.	Methods	CDv2	CDv1	DFDC	DFDCP	DFD	Avg.
F3Net (ECCV’20)	78.9	–	71.8	74.9	84.4	77.5	Efficient-b4† (ICML’19)	74.9	70.5	69.6	72.8	81.5	73.9
CLIP† (ICML’21)	88.4	89.6	83.3	86.3	92.6	88.0	CLIP† (ICML’21)	83.2	86.1	80.7	82.4	87.7	84.0
LaV (MM’23)	92.2	84.7	82.0	89.7	96.8	89.1	Face X-Ray (CVPR’20)	67.9	70.9	63.3	69.4	76.7	69.6
IID (CVPR’23)	83.8	–	70.0	68.9	93.9	79.2	RECCE (CVPR’22)	73.2	–	71.3	74.2	74.2	73.2
CFM (TIFS’23)	89.7	–	70.6	80.2	95.2	83.9	UCF† (ICCV’23)	82.4	77.9	80.5	75.9	87.8	80.9

TABLE V : Our method outperforms existing methods on five cross-domain datasets. “–” indicates that the results are not reported in the original paper, and † indicates that the results are obtained by using the official pre-trained model or reproduction, and some results are cited from [ 9 , 10 ] . Top results are highlighted in bold .

Methods	Video-level AUC							Methods	Frame-level AUC
Methods	UniFace	e4s	FaceDancer	FSGAN	InSwap	SimSwap	Avg.	Methods	UniFace	e4s	FaceDancer	FSGAN	InSwap	SimSwap	Avg.
CLIP (ICML’21)	91.0	91.6	89.8	96.0	88.5	80.3	89.5	CLIP (ICML’21)	86.5	87.8	85.6	92.0	83.9	76.3	85.4
RECCE (CVPR’22)	89.8	68.3	84.8	94.9	84.8	76.8	83.2	RECCE (CVPR’22)	84.2	65.2	78.3	88.4	79.5	73.0	78.1
SBI (CVPR’22)	72.4	75.0	59.4	80.3	71.2	70.1	71.4	IID (CVPR’23)	79.5	71.0	79.0	86.4	74.4	64.0	75.7
UCF (ICCV’23)	83.1	73.1	86.2	93.7	80.9	64.7	80.3	SBI (CVPR’22)	64.4	69.0	44.7	87.9	63.3	56.8	64.4
IID (CVPR’23)	83.9	76.6	84.4	92.7	78.9	64.4	80.2	UCF (ICCV’23)	78.7	69.2	80.0	88.1	76.8	64.9	76.3

TABLE VI : Our method achieves superior results on unseen manipulation methods. Results are reported on six representative face-swapping methods selected from DF40, where all samples are generated based on the FF++ domain.

Methods	GAN						Deep fakes	Low level		Perceptual loss		Guided	LDM			Glide			Dalle	Avg.
Methods	Pro- GAN	Cycle- GAN	Big- GAN	Style- GAN	Gau- GAN	Star- GAN	Deep fakes	SITD	SAN	CRN	IMLE	Guided	200 steps	200 w/cfg	100 steps	100 27	50 27	100 10	Dalle	Avg.
CNN-Spot (CVPR’20)	100.0	85.2	70.2	85.7	79.0	91.7	53.5	66.7	48.7	86.3	86.3	60.1	54.0	55.0	54.1	60.8	63.8	65.7	55.6	69.6
Patchfor (ECCV’20)	75.0	69.0	68.5	79.2	64.2	63.9	75.5	75.1	75.3	72.3	55.3	67.4	76.5	76.1	75.8	74.8	73.3	68.5	67.9	71.2
Co-occurence (ArXiv’20)	97.7	63.1	53.8	92.5	51.1	54.7	57.1	63.1	55.9	65.7	65.8	60.5	70.7	70.5	71.0	70.2	69.6	69.9	67.5	66.9
Freq-spec (WIFS’20)	49.9	99.9	50.5	49.9	50.3	99.7	50.1	50.0	48.0	50.6	50.1	50.9	50.4	50.4	50.3	51.7	51.4	50.4	50.0	55.5
F3Net (ECCV’20)	99.4	76.4	65.3	92.6	58.1	100.0	63.5	54.2	47.3	51.5	51.5	69.2	68.2	75.3	68.8	81.7	83.2	83.0	66.3	71.3

TABLE VII : ACC (%) performance on the UniversalFakeDetect dataset. Following [ 39 ] , ProGAN is used for training, and selected results are cited from [ 9 ] . Our method achieves the best average performance and demonstrates competitive or superior results across most generative categories.

Methods	Midjourney	SDv1.4	SDv1.5	ADM	GLIDE	Wukong	VQDM	BigGAN	Avg.
ResNet-50 (CVPR’16)	54.9	99.9	99.7	53.5	61.9	98.2	56.6	52.0	72.1
DeiT-S (ICML’21)	55.6	99.9	99.8	49.8	58.1	98.9	56.9	53.5	71.6
Swin-T (ICCV’21)	62.1	99.9	99.8	49.8	67.6	99.1	62.3	57.6	74.8
CNNSpot (CVPR’20)	52.8	96.3	95.9	50.1	39.8	78.6	53.4	46.8	64.2
Freq-spec (WIFS’20)	52.0	99.4	99.2	49.7	49.8	94.8	55.6	49.8	68.8
F3Net (ECCV’20)	50.1	99.9	99.9	49.9	50.0	99.9	49.9	49.9	68.7

TABLE VIII : ACC (%) performance on the GenImage dataset. Our method achieves the best average ACC while maintaining balanced performance across diverse generative categories.

Single-SVD Training for Face Forgery
Infer	Ref. Dataset	Metric	CD2	DFDC	e4s	FaceDancer	Avg.all
P-Infer	–	ACC	83.0	77.2	93.7	87.3	86.0
P-Infer	–	AUC	90.4	86.2	98.1	94.1	92.8
Batch-SVD Training for Face Forgery
P-Infer	–	ACC	82.7	76.4	93.1	87.0	85.6
P-Infer	–	AUC	90.4	85.5	97.9	93.9	92.4

TABLE IX : Comparison of different training and inference protocols for face forgery detection. We report ACC and frame-level AUC (%) on 11 test datasets.

Infer	Metric	CycleGAN
Infer	Metric	Apple	horse	Orange	Summer	Avg.all
R-Infer	ACC	99.6	99.8	99.4	99.3	99.4
B-Infer	ACC	99.6	99.7	99.4	99.3	99.4
Infer	Metric	ProGAN
Infer	Metric	Airplane	Bicycle	Car	Dog	Avg.all
R-Infer	ACC	100.0	100.0	100.0	100.0	100.0

TABLE X : Comparison of different inference protocols for the natural-image setting. ACC (%) is reported on category-specific images generated by CycleGAN and ProGAN.

Fig. 5 : (a) The semantic variance is highly concentrated in the first few principal components, particularly the first and second ones, while the remaining components contribute only marginally. (b) We compare six insertion strategies and report ACC (%) on the testing datasets.

$\lambda$	CDv2	DFDCP	DFDC	e4s	InSwap	Avg.
$0.05$	81.2	80.9	76.3	92.6	84.0	83.0
$0.1$	81.4	80.8	76.6	92.7	84.5	83.2
$0.2$	81.7	81.3	77.0	93.5	85.0	83.7
$0.4$	82.3	82.0	76.7	93.2	84.5	83.7
$0.6$	82.8	82.2	76.9	93.1	84.7	83.9
$0.8$	82.8	82.3	76.8	93.2	84.6	83.9

TABLE XI : Comparison under different subtraction strategies. We report ACC (%) on the testing datasets.

$k$	CDv2	DFD	DFDC	SimSwap	UniFace	Avg.
1	89.8	94.0	85.9	91.4	95.9	91.4
2	90.2	94.0	85.5	91.3	95.9	91.4
8	90.5	94.4	85.9	91.2	96.3	91.7
16	90.4	94.4	85.7	91.0	96.4	91.6
32	90.5	94.4	85.6	91.0	96.4	91.6
64	90.6	94.5	85.8	91.1	96.3	91.7

TABLE XII : Effect of the subspace dimension

k

on the testing datasets. Frame-level AUC (%) is reported.

Fig. 6 : Visualization of different initialization settings for $\lambda$ and the corresponding results (ACC, %) on the test datasets.

Batchsize	CDv1	DFD	DFDC	FaceDancer	FSGAN	Avg.
Different Training Batch Sizes (Test batch size $\times 4$ )
$\mathit{B_{tr}}=16$	90.6	94.4	85.0	93.6	96.3	92.0
$\mathit{B_{tr}}=32$	90.5	94.2	85.1	93.7	96.4	92.0
$\mathit{B_{tr}}=64$	90.9	94.1	86.1	93.6	96.4	92.2
$\mathit{B_{tr}}=128$	91.3	94.5	85.8	93.8	96.1	92.3
Different Inference Batch Sizes (Training Batch Size = 128)

TABLE XIII : Effect of training and inference batch sizes on frame-level AUC (%) over the testing datasets.

Method	CDv2	DFDCP	DFDC	InSwap	FaceDancer	Avg.
BLIP	83.3	81.5	76.9	87.5	81.0	82.0
+Ours	87.4 +4.1	84.9 +3.4	80.3 +3.4	91.2 +3.7	85.7 +4.7	85.9 +3.9
SigLIP	88.0	86.3	78.7	85.8	82.5	84.3
+Ours	91.3 +3.3	89.4 +3.1	81.0 +2.3	93.1 +7.3	89.9 +7.4	88.9 +4.7
CLIP	90.7	88.4	83.1	90.3	91.5	88.8
+Ours	96.4 +5.7	93.2 +4.8	88.6 +5.5	96.5 +6.2	97.5 +6.0	94.4 +5.6

TABLE XIV : Ablation studies (video-level AUC%) on different vision foundation models (VFMs).

Fig. 7 : Robustness analysis against common image corruptions. The curves illustrate the Video-level AUC (%) performance of our method versus existing approaches. We test across five different degradation scenarios, including Color Saturation, JPEG Compression, Color Contrast, Block-wise noise, and Gaussian Blur, plotted against increasing severity levels (0-5).

Fig. 8 : Feature visualization of different GSD inference strategies. We visualize the 3D t-SNE feature distributions under three deployment protocols, including Per-sample Inference, Batch Inference, and Reference-based Inference. The top row shows the semantic components preserved by the frozen semantic anchor, while the bottom row shows the semantically decoupled forgery features after GSD. Notably, across the three inference strategies, the semantic components exhibit highly similar feature spaces, while the semantically decoupled forgery features are mapped into an almost consistent forgery-oriented feature space.

Fig. 9 : t-SNE [ 5 ] visualization of feature distributions extracted by the naively finetuned CLIP (a, b, c) and GSD-CLIP (d, e, f, g, h, i) on cross-domain datasets. Points are colored by forgery labels and semantic labels.

AI-Generated Image Detection

AI-generated image detection identifies synthetic or AI-edited images and develops methods that generalize across generators, domains, and image transformations.

See all 194 papers

Decoupling Semantics and Fingerprints: A Universal Representation for AI-Generated Image Detection
May 8, 2026Zhiyuan Wang, Yanxiang Chen, Pengcheng Zhao +2Disentangled Representation Learning Domain Generalization
Hefei University of Technology · Key Laboratory of Knowledge Engineering with Big Data · Key Laboratory of Knowledge Engineering with Big Data (Hefei University of Technology), Ministry of Education; School of Computer Science and Information Engineering, Hefei University of Technology; and Intelligent Interconnected Systems Laboratory of Anhui Province (Hefei University of Technology) +3
NS-Net: Decoupling CLIP Semantic Information through NULL-Space for Generalizable AI-Generated Image Detection
Aug 2, 2025Jiazhen Yan, Fan Wang, Ziwen He +2AI-Generated Image Detection
Engineering Research Center of Digital Forensics, Ministry of Education, Nanjing University of Information Science and Technology, Nanjing, 210044, China. · University of Macau, Macau, 999078, China.
Structured Local Differential Modeling for AI-Generated Image Detection
Aug 13, 2026Jiazhen Yang, Ruijin Jin, Junjun Zheng +3Image Forgery Detection Digital Image Forensics
Zhejiang University · Taobao & Tmall Group of Alibaba · Zhejiang University of Technology

May 8, 2026J/K move · Enter open · S save

Decoupling Semantics and Fingerprints: A Universal Representation for AI-Generated Image Detection

Zhiyuan Wang, Yanxiang Chen, Pengcheng Zhao, Yunfeng Diao+1

Hefei University of Technology · Key Laboratory of Knowledge Engineering with Big Data · Key Laboratory of Knowledge Engineering with Big Data (Hefei University of Technology), Ministry of Education; School of Computer Science and Information Engineering, Hefei University of Technology; and Intelligent Interconnected Systems Laboratory of Anhui Province (Hefei University of Technology)+3

Disentangled Representation Learning Domain Generalization AI-Generated Image Detection

Open paper AskPDF arXiv

Detecting AI-generated images across unseen architectures remains challenging, as existing models often overfit to generator-specific fingerprints and semantic content rather than learning universal forgery traces. We attribute this failure to feature entanglement: detectors learn these factors as a single entangled representation, where universal forgery traces are inextricably confounded with both generator-specific fingerprints and semantic content. Crucially, our spectral analysis reveals that this entanglement is avoidable: distinct generator-specific fingerprints (e.g., GAN stripes vs. Diffusion Model spots) occupy disjoint frequency subspaces and coexist as independent superpositions. Leveraging this physical orthogonality, we propose the Orthogonal Decomposition and Purification Network (ODP-Net) to structurally disentangle these factors. Specifically, ODP-Net employs (1) Instance-aware Orthogonal Decomposition to project features into mutually exclusive subspaces: universal forgery traces, generator-specific fingerprints, and semantic content; (2) Perturbation-based Purification to enforce semantic invariance via cross-sample feature injection; and (3) Manifold Alignment to bridge domain gaps. By explicitly decoupling universal forgery traces from generator-specific fingerprints and semantic content, ODP-Net achieves state-of-the-art performance on unseen architectures (e.g., Stable Diffusion 3), validating that structural disentanglement is key to generalization.

Abstract

AI-Generated Image Detection

Explore similar work

Decoupling Semantics and Fingerprints: A Universal Representation for AI-Generated Image Detection

NS-Net: Decoupling CLIP Semantic Information through NULL-Space for Generalizable AI-Generated Image Detection

Structured Local Differential Modeling for AI-Generated Image Detection