Advances in image generation have made synthetic images increasingly difficult to distinguish from real photographs, raising concerns about the trustworthiness of visual media. Existing AI-generated image detectors often perform well on in-domain data, but their robustness and cross-generator generalization remain limited. These limitations are commonly attributed to overfitting to shortcut cues. Although many methods seek to suppress shortcut learning, most retain binary classification as the training task without reconsidering how the task itself shapes the learned representations. We introduce CuRe, a framework for learning Continuous Source Responses that revisits authenticity detection from the perspective of the training task. CuRe reformulates backbone adaptation as regression of real-generated mixing ratios, providing finer supervision that encourages the model to capture authenticity-related variation beyond binary endpoint separation. We further select a compact source-response subspace to suppress nuisance variation and limit the final classifier's access to potential shortcut cues. Across ten public benchmarks, CuRe achieves an average balanced accuracy of 89.7%, exceeding the second-best method by 5.2 percentage points. Further experiments demonstrate consistent generalization gains across visual backbones and strong robustness to common image degradations. Code is available at https://github.com/manic-cui/CuRe
Figures & tables
Figure 1: Comparison of binary and continuous source supervision. Left: binary labels provide only coarse endpoint supervision, allowing models to learn decision boundaries based on different shortcuts (dashed curves), potentially compromising robustness and generalization. Right: CuRe constructs continuous transitions from real ( α=0 ) to generated ( α=1 ) images and predicts the mixing ratio α , providing finer-grained supervision that encourages the encoder to distinguish intermediate states and become more sensitive to changes in image authenticity.
Figure 2: Representation analysis using PE Core L/14 on GenImage. Frozen and binary-trained features retain pronounced semantic structure, and binary training additionally separates the two JPEG qualities. In contrast, continuous source-change training yields greater mixing across semantic and format groups while producing clearer separation between real and generated samples.
Figure 3: Overview of the CuRe framework. Stage 1 (left) adapts the backbone with LoRA to predict the mixing ratio of real–generated image interpolations, encouraging sensitivity to continuous source changes. Stage 2 (upper right) uses the frozen adapted encoder and real–generated trajectories to extract a compact subspace that preserves source responses while suppressing content and mixing-related variation.
Standard Benchmarks
In-the-Wild Benchmarks
Method
AIGCDetect
AIGIBench
UnivFD
EvalGEN
SynthWildX
WildRF
BFree-On.
RRDataset
RealChain
Chameleon
Overall Avg.
NPR (CVPR’24) ( Tan et al., 2024 )
63.5
63.9
53.5
86.3
47.4
51.9
46.7
49.3
50.7
54.9
56.8
UnivFD (CVPR’23) ( Ojha et al., 2023 )
67.4
74.7
50.8
94.5
61.6
57.3
64.9
61.2
66.1
62.1
66.1
FatFormer (CVPR’24) ( Liu et al., 2024 )
61.3
63.4
52.6
65.1
52.6
57.7
60.7
50.3
50.0
50.6
56.4
C2P-CLIP (AAAI’25) ( Tan et al., 2025 )
78.4
69.6
91.6
66.4
55.3
59.5
50.0
52.7
50.2
50.7
62.4
DRCT (ICML’24) ( Chen et al., 2024 )
68.3
73.4
56.7
75.4
74.6
73.8
73.8
60.5
64.9
68.5
69.0
Table 1: Overall comparison across AIGI detection benchmarks. All entries are in % and all accuracy values are balanced accuracy. Each benchmark score is the unweighted macro-average over its evaluated subsets when applicable. Best and second-best average results are marked in bold and underlined, respectively.
Subset Subset Subset
NPR NPR NPR
UnivFD UnivFD UnivFD
FatFormer FatFormer FatFormer
C2P-CLIP C2P-CLIP C2P-CLIP
DRCT DRCT DRCT
SAFE SAFE SAFE
DDA DDA DDA
GAPL GAPL GAPL
DGS-Net DGS-Net DGS-Net
CuRe CuRe CuRe
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
GAN-based Noise-to-Image Generation
ProGAN
50.4
50.9
52.7
55.1
58.0
84.7
98.5
99.8
54.5
61.5
51.6
53.1
85.3
98.5
99.7
100.0
94.9
99.0
95.2
99.8
R3GAN
62.5
67.5
71.5
80.5
50.3
78.3
83.6
93.9
49.0
40.7
63.0
54.6
95.8
99.1
96.2
99.8
72.4
85.0
96.1
99.0
StyleGAN3
62.6
77.4
65.0
72.5
78.1
92.8
93.1
98.8
52.2
59.5
53.4
62.2
63.3
77.1
97.0
99.7
61.4
79.0
92.6
97.9
StyleGAN-XL
68.4
72.9
75.9
84.1
64.2
86.7
91.3
97.7
49.0
46.1
64.9
79.9
48.8
43.3
95.3
99.0
53.7
72.6
96.9
99.7
Table 2: Subset-level results on AIGIBench. Each method reports B.Acc./AUC (%). Best and second-best results in the Average row are marked in bold and underlined, respectively.
Figure 4: Cross-backbone comparison under different LoRA ranks on AIGIBench. Within each backbone, paired bars compare binary supervision (blue) and continuous-ratio supervision (teal with diagonal hatching) at r∈{16,32,64} . Bars report ROC-AUC.
Subset Subset Subset
NPR NPR NPR
UnivFD UnivFD UnivFD
FatFormer FatFormer FatFormer
C2P-CLIP C2P-CLIP C2P-CLIP
DRCT DRCT DRCT
SAFE SAFE SAFE
DDA DDA DDA
GAPL GAPL GAPL
DGS-Net DGS-Net DGS-Net
CuRe CuRe CuRe
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
SynthWildX
DALL-E 3
41.1
33.0
63.7
71.8
52.2
65.9
54.9
66.7
85.1
91.8
58.1
57.0
92.4
97.4
87.2
94.3
49.4
51.9
94.6
97.5
Firefly
49.5
46.9
59.0
63.7
52.6
51.8
59.1
78.8
59.3
67.7
53.3
54.8
86.8
93.7
87.4
94.9
51.9
67.2
88.6
94.5
Midjourney v5
51.6
49.0
62.2
70.2
53.2
62.3
51.8
63.4
79.3
88.6
56.5
58.4
92.8
97.9
84.6
92.6
49.5
49.1
94.9
97.7
Average
47.4
43.0
61.6
68.6
52.6
60.0
55.3
69.6
74.6
82.7
56.0
56.7
90.7
96.3
86.4
93.9
50.3
56.1
92.7
96.6
Table 3: Subset-level results on SynthWildX and WildRF. Each method reports B.Acc./AUC (%). SynthWildX pairs each generated subset with the shared real set. Best and second-best results in the Average rows are marked in bold and underlined, respectively.
Table 8
Figure 5: Robustness of CuRe and four strong comparison methods on AIGIBench (BAcc). Each panel varies one post-processing factor while holding the other two at their clean settings.
Appendix figures & tables5 assets
Supplementary material from the paper’s appendix.
Appendix
Subset Subset Subset
NPR NPR NPR
UnivFD UnivFD UnivFD
FatFormer FatFormer FatFormer
C2P-CLIP C2P-CLIP C2P-CLIP
DRCT DRCT DRCT
SAFE SAFE SAFE
DDA DDA DDA
GAPL GAPL GAPL
DGS-Net DGS-Net DGS-Net
CuRe CuRe CuRe
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
GAN-based Generation
BigGAN
45.9
45.3
49.5
55.3
50.2
68.6
98.3
99.9
53.4
61.1
50.0
44.9
87.2
94.8
98.0
100.0
88.3
94.7
93.5
99.7
CycleGAN
70.2
84.7
53.0
60.5
55.5
92.9
98.9
100.0
48.1
51.8
55.7
60.9
71.3
84.9
97.3
99.6
96.7
99.3
70.4
98.6
GauGAN
47.0
46.5
52.1
68.5
50.9
84.3
98.6
99.8
50.1
43.6
49.5
43.8
88.8
95.9
99.4
100.0
88.4
94.4
94.2
99.8
ProGAN
50.4
50.9
52.7
55.1
58.0
84.7
98.5
99.8
54.5
61.5
51.6
53.1
85.3
98.5
99.7
100.0
94.9
99.0
95.2
99.8
Appendix
Table 6: Subset-level results on AIGCDetectBenchmark. Each method reports B.Acc./AUC (%). Best and second-best results in the Average row are marked in bold and underlined, respectively.
Subset Subset Subset
NPR NPR NPR
UnivFD UnivFD UnivFD
FatFormer FatFormer FatFormer
C2P-CLIP C2P-CLIP C2P-CLIP
DRCT DRCT DRCT
SAFE SAFE SAFE
DDA DDA DDA
GAPL GAPL GAPL
DGS-Net DGS-Net DGS-Net
CuRe CuRe CuRe
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
B.Acc.
AUC
BigGAN
45.9
45.3
49.5
55.3
50.2
68.6
98.3
99.9
53.4
61.1
50.0
44.9
87.2
94.8
98.0
100.0
88.1
94.5
93.5
99.7
CRN
46.3
23.6
46.7
42.4
49.7
55.9
91.3
98.8
50.3
47.2
51.4
60.5
78.6
89.8
89.8
97.1
61.3
70.1
72.4
84.7
CycleGAN
70.2
84.7
53.0
60.5
55.5
92.9
98.9
100.0
48.1
51.8
55.7
60.9
71.3
84.9
97.3
99.6
96.3
99.1
70.4
98.6
Deepfake
52.6
53.3
54.4
63.8
57.3
75.7
92.6
97.2
59.7
62.6
50.0
48.6
75.2
84.9
85.2
96.4
61.5
76.9
64.5
96.7
GauGAN
47.0
46.5
52.1
68.5
50.9
84.3
98.6
99.8
50.1
43.6
49.5
43.8
88.8
95.9
99.4
100.0
88.5
94.4
94.2
99.8
Appendix
Table 7: Subset-level results on UnivFakeDetect. Each method reports B.Acc./AUC (%). Best and second-best results in the Average row are marked in bold and underlined, respectively.
Backbone
Supervision
r=16
r=32
r=64
CLIP ViT-L/14
Binary
75.42
72.20
74.89
CuRe (Ours)
79.42
79.34
80.13
Δ
+4.00
+7.14
+5.24
DINOv2 ViT-L/14
Binary
74.32
72.52
76.57
CuRe (Ours)
81.21
81.79
83.49
Δ
+6.89
+9.27
+6.92
Appendix
Table 8: Detailed cross-backbone results corresponding to Figure 4 . ROC-AUC scores and their differences are reported in % on AIGIBench. Δ is computed by subtracting the binary supervision score from the CuRe score.
Setting
UnivFD
DRCT
DDA
GAPL
CuRe (Ours)
JPEG compression
q=100
74.70
73.40
85.00
91.30
92.80
q=90
72.19
72.00
82.00
89.14
93.09
q=70
73.22
71.09
77.23
85.78
92.74
q=50
70.64
67.73
74.17
81.87
91.72
q=30
64.78
64.71
70.53
74.68
90.43
Appendix
Table 9: Detailed robustness results corresponding to Figure 5 . Each entry is the 20-subset macro-average B.Acc. (%) on AIGIBench. Only one post-processing factor is varied at a time, while the other factors remain at their clean settings.
Dataset
Real/Fake
Source
#Models
Model types
AIGCDetectBenchmark ( Zhong et al., 2023 )
76.3k/76.3k
LSUN, MSCOCO, ImageNet, CelebA, FFHQ
17
GAN, diffusion
AIGIBench ( Li et al., 2025c )
84.0k/84.0k
Curated sources, social media, AI-art platforms
20
GAN, diffusion, personalized, other
UnivFakeDetect ( Ojha et al., 2023 ; Wang et al., 2020 )
45.2k/45.2k
LSUN, ImageNet, CelebA, and others
13
GAN and other
EvalGEN ( Chen et al., 2025 )
0/55.3k
Prompts
5
Diffusion, autoregressive
SynthWildX ( Cozzolino et al., 2024 )
0.5k/1.5k
X
3
Commercial text-to-image
WildRF ( Cavia et al., 2024 )
1.3k/1.3k
Reddit, Facebook, X
Unknown
Unknown
Appendix
Table 10: Test-set statistics of the ten evaluation benchmarks, including image counts, data sources, and generator coverage. Real/Fake lists the numbers of real and generated images; a combined count is marked as total. Counts above one thousand are expressed in thousands (k), rounded to one decimal place. Shared real-image pools are counted once, and additional real images used only for evaluation pairing are excluded. Unknown indicates that the generator identity or model family is unavailable for in-the-wild images.
AI-generated image detection identifies synthetic or AI-edited images and develops methods that generalize across generators, domains, and image transformations.
Generative models can now synthesize highly realistic images, simultaneously increasing the risks of misinformation and visual forgery. Therefore, detecting AI-generated images becomes more essential, and a reliable detector must generalize to unseen generators and stay robust to unseen perturbations in the wild. Existing detectors are typically trained on either independently collected real and generated images or aligned real-generated pairs designed to mitigate content bias. Building on aligned pairs, recent methods form a mixed view by replacing some patches of the real image with their generated counterparts. However, we find that self-attention lets real and generated patches interact, so the feature of each patch no longer reflects its own source alone. This contextual shift makes a per-patch source label an imprecise target. To this end, we propose Relative Patch Response Learning (PRL). Instead of labeling each patch, PRL compares the same patch across two mixed views of an aligned pair and learns from its patch response, the change of its score between the views. (i) To give precise supervision under the contextual shift, a relative response objective measures the responses of source-changed patches against those of source-unchanged patches, which respond to the shift alone. (ii) To provide a reliable reference for the shift, a reference coherence objective keeps each group of source-unchanged patches moving as a whole. (iii) Since the two views contain different amounts of generated content, an area ranking objective asks the view with the larger generated area to have a higher mean patch score. Extensive experiments demonstrate the superior performance of PRL, which surpasses the best prior methods by 4.3% and 5.9% in average balanced accuracy across eight standard and three in-the-wild benchmarks, respectively.
Tianyu Wang, Ouxiang Li, Yanbin Hao +2
University of Science and Technology of China · Hefei University of Technology · University of Macau
Recent image generators produce photo-realistic content that undermines the reliability of downstream recognition systems. As visual appearance cues become less pronounced, appearance-driven detectors that rely on forensic cues or high-level representations lose stability. This motivates a shift from appearance to behavior, focusing on how images respond to controlled perturbations rather than how they look. In this work, we identify a simple and universal behavioral signal. Natural images preserve stable semantic representations under small, structured perturbations, whereas generated images exhibit markedly larger feature drift. We refer to this phenomenon as robustness asymmetry and provide a theoretical analysis that establishes a lower bound connecting this asymmetry to memorization tendencies in generative models, explaining its prevalence across architectures. Building on this insight, we introduce Robustness Asymmetry Detection (RA-Det), a behavior-driven detection framework that converts robustness asymmetry into a reliable decision signal. Evaluated across 14 diverse generative models and against more than 10 strong detectors, RA-Det achieves superior performance, improving the average performance by 7.81 percent. The method is data- and model-agnostic, requires no generator fingerprints, and transfers across unseen generators. Together, these results indicate that robustness asymmetry is a stable, general cue for synthetic-image detection and that carefully designed probing can turn this cue into a practical, universal detector. The source code is publicly available at Github.
Generalization remains a critical bottleneck in AI-generated image detection. Because many modern generators are proprietary or adversarially modified, existing detectors overfit to the low-level textural patterns of accessible training data, resulting in severe failures on unseen domains. Conventional regularization techniques (e.g., L1/L2 norms, Dropout) apply indiscriminate parametric constraints and fail to provide the domain-invariant structure necessary for cross-generator robustness. To address this, we propose Feature-Augmented Implicit Regularization (FAIR). FAIR introduces an orthogonal, macro-structural prior, specifically, Scene Composition Structure (SCS), during training to geometrically constrain the model's optimization trajectory. By augmenting the primary feature space with domain-invariant SCS features, FAIR explicitly penalizes texture-biased shortcut learning. Crucially, this structural prior is entirely discarded at inference, yielding a smoothed, generalized decision boundary with zero architectural or computational overhead. Extensive evaluations across five massive benchmarks demonstrate that integrating FAIR into state-of-the-art detectors significantly improves cross-generator generalization, boosting accuracy by up to 8.04% and establishing new state-of-the-art robustness in zero-shot transfer scenarios.
Md Redwanul Haque, Manzur Murshed, Manoranjan Paul +1
Deakin University, Burwood, VIC, Australia · Charles Sturt University, Bathurst, NSW, Australia