Recently, detecting AI-generated images produced by diffusion-based models has attracted increasing attention due to their potential threat to safety. Among existing approaches, reconstruction-based methods have emerged as a prominent paradigm for this task. However, we find that such methods exhibit severe security vulnerabilities to adversarial perturbations; that is, by adding imperceptible adversarial perturbations to input images, the detection accuracy of classifiers collapses to near zero. To verify this threat, we present a systematic evaluation of the adversarial robustness of three representative detectors across four diverse generative backbone models. First, we construct adversarial attacks in white-box scenarios, which degrade the performance of all well-trained detectors. Moreover, we find that these attacks demonstrate transferability; specifically, attacks crafted against one detector can be transferred to others, indicating that adversarial attacks on detectors can also be constructed in a black-box setting. Finally, we assess common countermeasures and find that standard defense methods against adversarial attacks provide limited mitigation. We attribute these failures to the low signal-to-noise ratio (SNR) of attacked samples as perceived by the detectors. Overall, our results reveal fundamental security limitations of reconstruction-based detectors and highlight the need to rethink existing detection strategies.
Figures & tables
Figure 1: Adversarial attack on reconstruction-based detectors. Left : The detector correctly classifies real images (top row) and generated images (bottom row). Middle : Imperceptible adversarial perturbations ( ×15 magnified). Right : Adversarial samples obtained by adding the perturbations, the detector’s predictions are completely reversed.
Figure 2: Overview of the adversarial attack pipeline. Perturbations are optimized by backpropagating gradients through the coupled reconstruction and detection modules, treating the entire pipeline as a differentiable function.
Figure 3: Detection performance under white-box attack. Blue lines indicate baseline accuracy on benign samples; red lines denote robust accuracy on adversarial examples.
Figure 4: Adversarial transferability threat models. The pipeline shows perturbations δ generated on a Surrogate detector (top, gray) and transferred to a Target detector (bottom, beige). Each detector’s configuration is denoted by two color-coded blocks: Training Data (top) and Detection Method (bottom).
Figure 5: Cross-generator transfer attack results. Rows indicate the generator used to train the surrogate detector (source); columns indicate the generator used to train the target detector.
Figure 6: Cross-method transfer attack results. Heatmaps show post-attack accuracy (%) where the source method (rows) attacks the target method (columns).
Surrogate
Target
Avg. Robust Acc. (%)
DIRE
LaRE 2
50.39±0.71
AEROBLADE
50.00±0.00
LaRE 2
DIRE
52.04±4.30
AEROBLADE
50.00±0.00
AEROBLADE
DIRE
49.27±1.16
LaRE 2
49.93±0.18
Table 1: Fully black-box transfer attack. We report the average post-attack robust accuracy (%) across all 4 × 4 training source combinations for each detection method pair. The performance consistently collapses to near random-guessing ( ≈50% ).
Figure 7: Impact of Diffusion Purification on defense robustness. The plots illustrate detection accuracy (%) across varying purification strengths t for four generative sources.
Detection Method
Generator
Clean Acc. (%)
Robust Acc. (%)
DIRE
ADM
64.4
0.0
FLUX
85.6
0.0
SDv1.5
77.4
0.0
VQDM
76.4
3.4
LaRE 2
ADM
74.0
23.1
FLUX
98.1
90.3
Table 2: Impact of Adversarial Training across different generators. We observe that DIRE collapses on all subsets, while LaRE 2 maintains modest robustness.
Figure 8: Analysis of the relative perturbation variation ρ(x) . (a) and (b) illustrate the Proportion distributions of ρ for real and fake images evaluated on FLUX. (c) compares the mean ρ across different generative models.
Appendix figures & tables13 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 9: Detection performance under benign conditions. Each heatmap visualizes the accuracy (%) when classifiers trained on one generator (rows) are evaluated on images from another (columns).
Figure 10: Ablation of attack hyperparameters on DIRE.
Figure 11: Ablation of attack hyperparameters on LaRE 2 .
Figure 12: Ablation of attack hyperparameters on AEROBLADE.
Figure 13: Detection accuracy under random Gaussian noise.
Figure 14: Fully black-box transfer attack results. Each subplot shows transferability from one detection method (rows: surrogate) to another (columns: target), with generators varying across cells. Values denote post-attack accuracy (%); diagonal entries share the same generator (cross-method only), off-diagonal entries represent the fully black-box setting.
Figure 15: The fraction of pure random noise images predicted as “Real” by various classifiers.
Figure 16: Extended distributions of relative perturbation variations ρ across four generators and three detectors.
Figure 17: Mean Relative Perturbation ( μρ ) across detectors and datasets. We compare the perturbation magnitude induced by White-box attacks (IID), Cross-generator Transfer attacks (OOD), and Random Gaussian noise.
Figure 18: Density distributions of ρ comparing IID attacks, OOD transfer attacks, and Random Gaussian noise ( ε=8/255 ).
Figure 19: Visualizations of Adversarial Attacks against DIRE. The rows in each subfigure from top to bottom represent: Original Image, Adversarial Perturbation ( ×15 magnified), and the resulting Adversarial Example.
Figure 20: Visualizations of Adversarial Attacks against LaRE 2 . The rows in each subfigure from top to bottom represent: Original Image, Adversarial Perturbation ( ×15 magnified), and the resulting Adversarial Example.
Figure 21: Visualizations of Adversarial Attacks against AEROBLADE. The rows in each subfigure from top to bottom represent: Original Image, Adversarial Perturbation ( ×15 magnified), and the resulting Adversarial Example.
The impressive visual quality and ubiquity of AI-generated images call for reliable and robust detection methods. Reconstruction-based detectors have emerged as a promising direction for transparent and training-free identification of synthetic images. However, due to their fundamentally different mode of operation (compared to standard, classifier-based methods), little is known about their adversarial robustness. In this work, we propose two novel attack methods targeted at detectors that leverage autoencoder reconstruction error. We find that by constructing imperceptible adversarial examples, the distance between original and reconstruction can be artificially increased, causing fake images to be wrongly classified as real. Our evaluation including images from three state-of-the-art generators and three detectors demonstrates that detection performance is significantly decreased, even if attacked images additionally undergo real-world degradations. Critically, our adversarial examples naturally transfer across detectors, as they all share the same principle, pointing towards an inherent vulnerability of reconstruction-based detectors.
Vision foundation models have recently emerged as powerful feature extractors for detecting AI-generated images, achieving strong generalization across generators and robustness to common image degradations. However, the reason behind their effectiveness is poorly understood. In this work, we investigate what cues are exploited by foundation-model-based detectors to distinguish real images from diffusion-generated ones. To this end, we design an ad hoc analysis protocol based on DDIM inversion. Given a real image we generate a sequence of synthetic copies by changing the depth of DDIM inversion. Even though most copies are semantically identical to the real reference, the detector score varies significantly across them due to subtle traces introduced by the diffusion synthesis, showing that its decision is not primarily driven by semantic failures. Through a frequency-swapping analysis, we further reveal that the discriminative cues exploited by the detectors are mainly localized in the low-to-mid frequency range, rather than only in the high-frequency range, as is the case for artifacts commonly associated with generative models. Finally, a latent-space analysis shows that regenerated images exhibit reduced variance and effective dimensionality, indicating that diffusion models do not fully reproduce the variability of real data. Overall, our results suggest that foundation-model-based detectors succeed by capturing non-semantic low-to-mid frequency distributional discrepancies between real and diffusion-generated images. These findings provide new insight into the robustness and generalization of such detectors and suggest directions for more interpretable forensic methods.
Davide Cozzolino, Giovanni Poggi, Luisa Verdoliva
University Federico II of Naples, 80125 Naples, Italy
Diffusion models are able to produce AI-generated images that are almost indistinguishable from real ones. This raises concerns about their potential misuse and poses substantial challenges for detecting them. Many existing detectors rely on reconstruction error -- the difference between the input image and its reconstructed version -- as the basis for distinguishing real from fake images. However, these detectors become less effective as modern AI-generated images become increasingly similar to real ones. To address this challenge, we propose a novel difference-in-difference method. Instead of directly using the reconstruction error (a first-order difference), we compute the difference in reconstruction error -- a second-order difference -- for variance reduction and improving detection accuracy. Extensive experiments demonstrate that our method achieves strong generalization performance, enabling reliable detection of AI-generated images in the era of generative AI.
Xinyi Qi, Kai Ye, Chengchun Shi +3
The London School of Economics and Political Science · University of Birmingham