Attention Capture Is Not Detection: A Two-Stage Account of How Humans Miss Localized AI Image Edits

Chiao-Chieh Deng

cs.CVAug 14, 2026

Attention Capture Is Not Detection: A Two-Stage Account of How Humans Miss Localized AI Image Edits

Authors: Chiao-Chieh Deng

Organizations: Bachelor’s Program in Artificial Intelligence National Chengchi University, Taipei, Taiwan

Abstract

As AI-generated image edits proliferate, the platforms meant to curb the resulting disinformation treat detectability as a single, undifferentiated property: an edit either gets a warning or it does not. We show this is the wrong model. Across a controlled eye-tracking study ( $N=59$ , Latin-square design, four conditions crossing edit area and semantic plausibility), a mixed-effects analysis reveals that whether an edit is noticed and whether it is correctly judged as fake are dissociable stages, governed by different factors: edit area drives attention capture ( $p<0.001$ ) while semantic plausibility drives judgment accuracy and look-but-fail-to-see (LBFS) error rates ( $p<0.001$ ). This dissociation survives correction for multiple comparisons; a secondary interaction between the two factors does not. This two-stage account extends a long-standing distinction in visual attention research (between pre-attentive capture and effortful recognition) into the new domain of AI-edit detectability. We then test whether a generative eye-movement model can computationally operationalize the attention-capture stage: a Transformer trained to generate scanpaths tracks per-image attention with strong discriminative power (Pearson $r=0.77$ -- $0.82$ across held-out stimuli) and, on the harder task of predicting LBFS incidence, modestly outperforms a two-parameter linear baseline even without access to the plausibility label ( $r=0.52$ vs. $r=0.48$ ). We report this comparison, our ablations, and our method's limitations (a single fixed train/validation split, not leave-one-subject-out) without inflation, consistent with responsibly communicating what a machine learning system can and cannot do to help curb AI-driven disinformation.

Figures & tables

Figure 1: One base image rendered across all five conditions (top row), with the corresponding inpainting mask (middle row) and that mask overlaid in translucent red on the unedited original (bottom row, with the edited-area percentage of image pixels). The mask (not an object-detection box) is what defines the AOI used throughout the paper. Object-replacement labels are taken directly from the stimulus-generation pipeline’s plan for this image: PS replaces the dog with a cat (9.7% of image area), PL replaces the bed with a leather ottoman (33.8%), IS replaces the dog with an implausible toaster (9.7%), and IL replaces the bed with an implausible surfboard (33.8%); the plausible/implausible pairs are matched on edit area within each size tier.

Figure 2: An AI edit must first capture attention (governed by edit area) before an attended edit can be correctly judged as fake versus missed as a look-but-fail-to-see error (governed by semantic plausibility). Unattended and unjudged branches are shown in gray.

Dependent variable	Plausibility effect	Size effect	Interaction
	(implausible vs. plausible)	(large vs. small)
Attention bias (chance-corrected)	$\beta{=}+0.160$ , $p{=}0.411$ (n.s.)	$\beta{=}-1.956$ , $p{<}0.001$ ***	$\beta{=}-0.160$ , $p{=}0.559$ (n.s.)
Judgment accuracy	$\beta{=}+0.774$ , $p{<}0.001$ ***	$\beta{=}+0.259$ , $p{=}0.011$ *	$\beta{=}+0.451$ , $p{=}0.027$ *
LBFS incidence	$\beta{=}-0.611$ , $p{<}0.001$ ***	$\beta{=}+0.229$ , $p{=}0.026$ *	$\beta{=}-0.549$ , $p{=}0.008$ **
log(RT)	$\beta{=}-0.066$ , $p{=}0.238$ (n.s.)	$\beta{=}-0.012$ , $p{=}0.838$ (n.s.)	$\beta{=}-0.057$ , $p{=}0.457$ (n.s.)

Table 1: Raw GLMM coefficients, DV ~ plausibility * size + (1|participant_id) . Accuracy/LBFS use logistic (binomial) family; attention bias/log(RT) use linear (see text). N per row: 1704 (attention bias, accuracy), 1381 (LBFS), 841 (log RT). *

p<.05

, **

p<.01

, ***

p<.001

(uncorrected; see Bonferroni discussion below).

Figure 3: SpatioTemporalGazeGen architecture, with tensor shapes at each stage. The visual side (top) combines three parallel branches over ViT patches (B,196,768): content (linear projection), DPE (distance-to-AOI, sinusoidal + MLP), and absolute 2D grid position (sinusoidal); these sum into a visual memory (B,197,128), after concatenating a condition token and layer-normalizing. The gaze side (bottom) combines content, CPE (a direct grid-cell embedding lookup, no sinusoidal step), and a temporal-position sinusoid, then passes through $N{=}3$ Pre-LN Transformer blocks (masked self-attention, cross-attention to the visual memory, feed-forward, each with a residual add) before a final layer norm and a mixture-density head over the next fixation, sampled and fed back in.

Figure 4: Generated vs. real scanpaths on two held-out stimuli (temperature 0.7, first 120 fixations; two real participants per panel, to show inter-observer spread). Left, a large edit: real and generated trajectories both enter and linger in the AOI. Right, a small edit (the clock, lower right) that neither the participant nor the model ever visits; both circle the unedited pizza instead. The right panel is the more informative one: reproducing where humans fail to look is what Section 7 requires, and is not what a model that merely tracks salient objects would produce.

Model	SS $\uparrow$	FED $\downarrow$	Exploration δ	First-entry δ	Re-entry δ	Dwell-run δ
Full	0.371	0.629	+0.118	+0.050	$-$ 0.306	+0.269
$-$ condition token	0.372	0.628	+0.115	+0.040	$-$ 0.263	+0.248
$-$ cross-attention	0.361	0.639	+0.121	+0.070	$-$ 0.274	+0.277
$-$ CPE	0.374	0.626	+0.313	+0.030	$-$ 0.557	+0.588
$-$ DPE	0.362	0.638	+0.077	+0.083	$-$ 0.309	+0.235
Deterministic (no MDN)	0.326	0.674	+0.453	+0.161	$-$ 0.131	+0.909

Table 2: Ablation study.

|

rel.diff

|

columns ( δ ) are absolute relative difference from human behavior on that statistic, closer to 0 = better; sign of the source values is dropped for readability. Single fixed seed=42 for controlled comparison.

Predictor	Correlation with real LBFS incidence rate
Linear(area, plausibility), LOOCV	$r=0.48$
Generated exploration (full model, with plausibility label)	$r=0.55$
Generated exploration (condition token removed, no plausibility label )	$r=0.52$

Table 3: Trivial-baseline comparison for predicting real LBFS incidence rate (leave-one-stimulus-out, n=163).

Scanpath Prediction

See all 8 papers

Explaining AI-Image Detection: What the Heatmap Actually Shows
Jul 31, 2026Leonid Kuturin, Ilya Sotnikov, Mark Khusnutdinov +4Image Forgery Detection Digital Image Forensics
Sirius Educational Centre, Big Challenges programme · HSE University, Faculty of Computer Science
MixDetect: Word-Level Localization and Quantification of AI Editing
Sep 26, 2026Hongrui Bao, Yubing Ren, Zhendong Pan +3AI-Generated Text Detection Robustness of Machine-Generated Text Detection
University of the Chinese Academy of Sciences · Institute of Information Engineering · Shandong University +1
SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data
Aug 13, 2026Yicheng Bao, Xiahui Guo, Xuhong Wang +1Adversarial Training Adversarial Examples
1East China Normal University · 2Shanghai Artificial Intelligence Laboratory

Jul 31, 2026J/K move · Enter open · S save

Explaining AI-Image Detection: What the Heatmap Actually Shows

Leonid Kuturin, Ilya Sotnikov, Mark Khusnutdinov, Mikhail Potemkin+3

Sirius Educational Centre, Big Challenges programme · HSE University, Faculty of Computer Science

Image Forgery Detection Digital Image Forensics Saliency Map Evaluation Explainable Image Classification Classification AI-Generated Image Detection

Open paper AskPDF arXiv

A marketplace review photograph is a document: platforms approve refunds on it, and generative models drove the cost of forging one to zero. We study that detection problem, so we build a detector and attach an attribution map as its evidence, then measure what that pair delivers on 186,527 images under controls designed to change our conclusions when something is wrong. Compression history, not synthesis, drives naive evaluation: our strongest model reaches 0.9999 PR-AUC (area under the precision-recall curve) on a product-disjoint split, yet falls to 0.7254 once we re-encode synthetics into the real class's format, while five public detectors move by at most 0.07. Aligning one class relocates the cue rather than removing it, and the repaired model then assigns native files a median probability of synthesis of 0.0004. One identical final encode for both classes repairs that, and a three-seed factorial credits the encoding change with the whole gain (+0.176 +- 0.009 PR-AUC). That encode equalises the last stage only: forensic features alone still separate the classes at 0.7145 against a base rate of 0.254. For evidence we test maps causally, against controls that never consult the detector. Whether an attribution ranking exists at all depends on whether the detector reacts to the image. On our first-fix detector, which calls 96 of 100 edited frames real, no map beats a random one. On the detector we selected, twelve of seventeen maps clear that control on edited images and eight on generated ones; perturbation leads both axes and no gradient-CAM variant shows a positive advantage. The trivial controls never clear it, and on generated images the centre prior is worse than random. Our ensembled regional map clears both axes and takes the top pixel AP at 12.4 s per map against 44.9 for occlusion. Clearing a detector-blind control is not yet a faithful explanation, and we demonstrate none.

Abstract

Scanpath Prediction

Explore similar work

Explaining AI-Image Detection: What the Heatmap Actually Shows

MixDetect: Word-Level Localization and Quantification of AI Editing

SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data