FARE: Forensic Acceptance Region Estimation for Catching Bait-and-Switch Image Generators

Kai Yao; Marc Juarez

cs.CVSep 25, 2026

FARE: Forensic Acceptance Region Estimation for Catching Bait-and-Switch Image Generators

Authors: Kai Yao, Marc Juarez

Organizations: School of Informatics The University of Edinburgh

Abstract

Modern AI image generators are increasingly deployed as opaque APIs, where customers can query the deployed service, but cannot inspect model weights or architecture. This creates a practical challenge: a provider may pass governance certification with one generator and later silently switch to a cheaper and lower-quality one for deployment, compromising public trust or even safety in high-stakes domains. We study integrity auditing at deployment time and propose FARE (Forensic Acceptance Region Estimation). A certified generator is enrolled by training FARE on images sampled from that generator. After deployment, FARE can determine whether a generated image is consistent with the enrolled generator---using only that image. FARE's features are based on image generator-specific artifacts that have been proposed for forensic applications. FARE amplifies these features during training by finding hard samples that tighten the acceptance region and increase sensitivity to subtle changes in the certified generator. Across generator swaps, including substitutions with similar model versions and model variants, FARE is effective at detecting swaps, consistently outperforming existing baselines at strict operating points, and remains effective under the exact-model and decision-only attacks evaluated in this work.

Figures & tables

Figure 1: FARE. Enrollment: using only images from the certified generator, we train a patch verifier in a forensic feature space. Training uses certified patches as negatives and two certified-derived positive sources: (i) near-boundary adversarial positives and (ii) contradiction positives from contract-violating perturbations (then re-tiled into patches). We then calibrate an image-level threshold at target FPR using the same patch tiling and top- $k$ aggregation. Verification: tile the queried image into patches, score anomalies, aggregate via top- $k$ mean, and accept/reject via Eq. ( 1 ).

Detection Method	Cross-Family Swaps		Within-Family Swaps
	CF-FFHQ	CF-Diff	WF-GANTrain	WF-SDVer
	TPR@1%FPR	TPR@1%FPR	TPR@1%FPR	TPR@1%FPR
Deep SVDD	12.46 $\pm$ 29.05	0.00 $\pm$ 0.00	1.23 $\pm$ 0.62	1.21 $\pm$ 1.06
OC-SVM	6.89 $\pm$ 15.51	0.00 $\pm$ 0.00	0.76 $\pm$ 0.49	2.79 $\pm$ 4.31
CLIP + OC-SVM	13.91 $\pm$ 31.48	0.00 $\pm$ 0.00	1.34 $\pm$ 0.52	1.73 $\pm$ 1.66
DCT Fingerprint + OC-SVM	11.46 $\pm$ 26.84	0.00 $\pm$ 0.00	0.89 $\pm$ 0.40	3.07 $\pm$ 4.40

Table 1: Single-image swap detection performance under cross-family and within-family swapping scenarios, compared with baselines. Except for the ASR row, each entry reports TPR@1%FPR across all evaluated cases within the scenario (details in Appendix A ). Cross-family covers CF-FFHQ (FFHQ-256 model pool) and CF-Diff (diffusion-dominated CommunityForensics pool). Within-family covers WF-GANTrain (StyleGAN training-configuration variants) and WF-SDVer (Stable Diffusion versioning). We also report performance under exact-model white-box PGD against the pretrained FARE network, with

\lVert\delta\rVert_{\infty}\leq 0.025

and

\mathrm{LPIPS}<0.05

. The final row reports conditional ASR: the percentage of initially detected non-certified images changed to accepted under these constraints. All task-specific fitting and calibration use only outputs from the certified generator.

Weight compression
Deployment Variant	Detection Performance (TPR@1%FPR)
	StyleGAN3	VDVAE	NCSN++	SD2.1
Quantization (INT6)	92.57 $\pm$ 0.91	91.03 $\pm$ 1.02	90.50 $\pm$ 1.10	86.42 $\pm$ 1.35
Quantization (INT4)	98.89 $\pm$ 0.34	97.14 $\pm$ 0.48	98.39 $\pm$ 0.29	98.27 $\pm$ 0.31
Mild Pruning	92.42 $\pm$ 0.88	93.44 $\pm$ 0.77	91.57 $\pm$ 0.95	87.36 $\pm$ 1.28
Heavy Pruning	98.44 $\pm$ 0.41	99.32 $\pm$ 0.22	97.53 $\pm$ 0.52	98.12 $\pm$ 0.36

Table 2: Single-image detection performance of FARE (TPR@1%FPR) under cost-motivated deployment variants across different generator architectures. For each model, the verifier is trained and calibrated on the default certified deployment, then evaluated on modified variants of the same model. Quantization and pruning are simulated weight transformations; reduced diffusion steps change the executed inference schedule.

Rule	$n$	WF-GANTrain (TPR@ $\alpha$ FPR)			WF-SDVer (TPR@ $\alpha$ FPR)
Rule	$n$	$\alpha=1\%$	$\alpha=0.5\%$	$\alpha=0.1\%$	$\alpha=1\%$	$\alpha=0.5\%$	$\alpha=0.1\%$
Single-image	1	96.38 $\pm$ 2.77	89.86 $\pm$ 2.64	71.53 $\pm$ 4.87	92.56 $\pm$ 3.06	85.49 $\pm$ 3.84	62.39 $\pm$ 5.27
Batch (Mean)	5	99.81 $\pm$ 0.24	99.67 $\pm$ 0.31	99.03 $\pm$ 0.46	99.46 $\pm$ 0.35	99.12 $\pm$ 0.43	98.27 $\pm$ 0.68
Batch (Mean)	10	99.92 $\pm$ 0.17	99.85 $\pm$ 0.23	99.47 $\pm$ 0.32	99.73 $\pm$ 0.26	99.41 $\pm$ 0.36	98.84 $\pm$ 0.49
Batch (Max)	5	99.48 $\pm$ 0.37	99.16 $\pm$ 0.45	98.29 $\pm$ 0.63	98.93 $\pm$ 0.42	98.57 $\pm$ 0.58	97.24 $\pm$ 0.86
Batch (Max)	10	99.65 $\pm$ 0.26	99.37 $\pm$ 0.34	98.74 $\pm$ 0.47	99.21 $\pm$ 0.33	98.86 $\pm$ 0.46	97.92 $\pm$ 0.67

Table 3: Batch verification performance of FARE at given operating points on within-family near-swaps. Entries report mean

\pm

std TPR@

\alpha

FPR at

\alpha\in\{1\%,0.5\%,0.1\%\}

for WF-GANTrain (StyleGAN training-configuration variants) and WF-SDVer (Stable Diffusion versioning).

Appendix figures & tables16 assets

Supplementary material from the paper’s appendix.

Appendix

Scenario	Certified deployment(s)	Non-certified deployment(s)	Resolution
CF-FFHQ	SG2, SG3-T, GANformer, StyleSwin, R3GAN, CIPS, VDVAE, VQVAE, NVAE, NCSN++, LDM, ADM	For each certified model, the remaining models in the pool	$256^{2}$
CF-Diff	SD1.4, SD1.5, SD2.0, SD2.1, SD3.5-Medium	Evaluation images from CommunityForensics	$512^{2}$
WF-GANTrain (SG2)	SG2-30k, SG2-70k, SG2-140k, SG2-30k-ADA, SG2-70k-ADA, SG2-140k-ADA	For each certified model, the remaining models in the pool	$256^{2}$
WF-GANTrain (SG3)	SG3-T, SG3-R, SG3-T-FFHQU, SG3-R-FFHQU	For each certified model, the remaining models in the pool	$256^{2}$
WF-SDVer	SD1.4, SD1.5, SD2.0, SD2.1, SD3.5-Medium	For each certified model, the remaining models in the pool	$512^{2}$

Appendix

Table A.1: Detailed definitions of the evaluation scenarios from Table 1 in the main paper. Abbreviations: SG2 = StyleGAN2, SG3-T = StyleGAN3-T (translation equiv.), SG3-R = StyleGAN3-R (translation and rotation equiv.), SD = Stable Diffusion, ADA = Adaptive Discriminator Augmentation, FFHQU = Unaligned FFHQ dataset

Method	Implementation details
Deep SVDD	The same convolutional backbone as FARE, but without the constrained front-end and with a $256$ -dimensional embedding head. The center is initialized from $5{,}000$ certified patches. Training uses $32\times 32$ patches and batch size $16$ . The image score is the top- $10$ mean of squared distances to the learned center.
OC-SVM (Patch)	A one-class SVM trained on frozen ResNet-50 patch descriptors. Certified $32\times 32$ patches are resized to $224\times 224$ . The RBF kernel uses $\nu=0.01$ and $\gamma=\texttt{scale}$ . Image scores are the top- $5$ mean of patch anomaly scores.
CLIP + OC-SVM	A one-class SVM trained on frozen CLIP ViT-B/32 image embeddings of a full image. The RBF kernel uses $\nu=0.01$ and $\gamma=\texttt{scale}$ .
DCT Feature + OC-SVM	A one-class SVM trained on our adapted $63$ -dimensional DCT fingerprints, motivated by [ 30 ] , computed from the mean absolute AC coefficients of each full image. The RBF kernel uses $\nu=0.01$ and $\gamma=\texttt{scale}$ . Because this baseline is image-level, no patch aggregation is applied.
FSD	A one-class model fitted to the frozen Forensic Self-Description representation [ 31 ] . Task-specific fitting and threshold calibration use only certified-generator outputs.
NPR + OC-SVM	A one-class SVM fitted to frozen Neighboring Pixel Relationships features [ 32 ] . Task-specific fitting and threshold calibration use only certified-generator outputs.

Appendix

Table A.2: Implementation details of the one-class and forensic baselines in Table 1

Hyperparameter	Value
Num certified training images	100,000
Num certified calibration images	10,000
Num verification images	10,000
Image resolution	$256\times 256$ for FFHQ pool (i.e. GAN/VAE/diffusion pool); $512\times 512$ for the conditioned SD family
Patch size $d$	$d=32$ for both training and verification
Top- $k$ parameter	$k=10$

Appendix

Table B.1: FARE network training and calibration hyperparameters. Unless stated otherwise, the same settings are used across all scenarios

Stage	Implemented setting
Constrained conv layer	Bayar–Stamm constrained depthwise convolution, kernel size $5$ , eight filters per RGB channel, constraint scale $1.0$
Channel mixing	$1\times 1$ conv from $24$ channels to width $64$ , followed by ReLU
Backbone	Six $3\times 3$ convolutional blocks with widths $(64,128,128,256,256,256)$ and strides $(1,2,1,2,1,1)$
Normalization	GroupNorm throughout the backbone
Head	Global average pooling, then a linear map from $256$ features to one logit

Appendix

Table B.2: FARE network architecture

Attack hyperparameter	Value
Attack type	PGD on image pixels as a white-box stress test against the deployed detector
Optimization objective	Minimize $s(x^{\prime})$ , i.e., the image-level detector score after top- $k$ aggregation
Perturbation budget $\lVert\delta\rVert_{\infty}$	$\epsilon=0.025$ with images normalized to $[0,1]$
Number of PGD steps	50 with early stopping after successful acceptance
Step size	0.001
Random restarts	5, retaining the best adversarial example across restarts

Appendix

Table B.3: Hyperparameters of the exact-model white-box PGD evaluation. Thresholds are kept fixed at the values calibrated on certified images

$d$	CF-FFHQ	CF-Diff	WF-GANTrain	WF-SDVer
8	91.24 $\pm$ 1.25	99.17 $\pm$ 0.67	92.42 $\pm$ 2.43	90.35 $\pm$ 5.42
32	99.43 $\pm$ 1.19	99.45 $\pm$ 0.88	96.38 $\pm$ 2.77	92.56 $\pm$ 3.06
128	89.93 $\pm$ 2.51	85.02 $\pm$ 4.53	70.11 $\pm$ 6.12	72.84 $\pm$ 9.43

Appendix

Table D.1: Ablation on patch size

d

. Results are reported as TPR@1%FPR.

$k$	CF-FFHQ	CF-Diff	WF-GANTrain (avg.)	WF-SDVer
5	98.87 $\pm$ 1.12	96.08 $\pm$ 2.34	94.86 $\pm$ 1.89	88.73 $\pm$ 3.45
10	99.43 $\pm$ 1.19	99.45 $\pm$ 0.88	96.38 $\pm$ 2.77	92.56 $\pm$ 3.06
50	99.49 $\pm$ 0.74	99.11 $\pm$ 1.02	95.74 $\pm$ 1.72	91.88 $\pm$ 2.41
100	95.54 $\pm$ 2.67	94.27 $\pm$ 3.11	92.91 $\pm$ 3.48	86.92 $\pm$ 4.92

Appendix

Table D.2: Ablation on the top-

k

image aggregation parameter. Results are reported as TPR@1%FPR.

$T_{\mathrm{warm}}$	CF-FFHQ	CF-Diff	WF-GANTrain	WF-SDVer
0	96.26 $\pm$ 2.14	98.71 $\pm$ 1.05	93.54 $\pm$ 2.88	89.92 $\pm$ 2.12
1,000	98.90 $\pm$ 1.45	99.23 $\pm$ 0.82	95.81 $\pm$ 1.94	92.84 $\pm$ 1.56
2,000	99.43 $\pm$ 1.19	99.45 $\pm$ 0.88	96.38 $\pm$ 2.77	92.56 $\pm$ 3.06
10,000	99.40 $\pm$ 1.02	99.68 $\pm$ 0.54	96.33 $\pm$ 1.68	92.13 $\pm$ 2.04

Appendix

Table D.3: Ablation on the certified-only warm-up length

T_{\mathrm{warm}}

. Results are reported as TPR@1%FPR.

Certified	30k	70k	140k	30k-A	70k-A	140k-A
SG2-30k	–	97.40	98.04	96.81	98.28	98.12
SG2-70k	98.45	–	91.67	98.08	93.49	93.82
SG2-140k	99.20	92.52	–	96.71	93.67	93.01
SG2-30k-ADA	97.72	97.14	97.54	–	94.44	94.78
SG2-70k-ADA	99.48	94.31	94.56	95.36	–	89.29
SG2-140k-ADA	99.53	94.73	93.82	95.83	90.11	–

Appendix

Table E.1: Pairwise WF-GANTrain results for StyleGAN2 training variants. Entries are TPR@1%FPR (%); A denotes ADA training.

Certified	SG3-T	SG3-R	SG3-T-FFHQU	SG3-R-FFHQU
SG3-T	–	99.01	96.93	99.93
SG3-R	99.83	–	99.93	96.11
SG3-T-FFHQU	96.02	99.19	–	98.98
SG3-R-FFHQU	99.20	95.18	99.82	–

Appendix

Table E.2: Pairwise WF-GANTrain results for StyleGAN3 variants. Entries are TPR@1%FPR (%).

Certified	SD1.4	SD1.5	SD2.0	SD2.1	SD3.5-M
SD1.4	–	85.85	90.29	91.02	93.32
SD1.5	89.53	–	89.58	90.54	93.96
SD2.0	94.06	93.97	–	87.63	93.40
SD2.1	94.01	94.12	90.87	–	92.88
SD3.5-M	97.03	95.95	96.57	96.62	–

Appendix

Table E.3: Pairwise WF-SDVer results. Entries are TPR@1%FPR (%).

Contradiction transform set	Mean TPR@1%FPR
All four transforms	98.84
Without Gaussian blur	86.76
Without Gaussian noise	94.28
Without JPEG compression	93.90
Without crop–resize	80.63

Appendix

Table E.4: Leave-one-out ablation of the contradiction transforms for a StyleGAN2-certified detector in CF-FFHQ (%).

Steps	Latency (s/image)	Energy (J/image)	Peak memory (GiB)	CLIP similarity
20	1.311	354.9	3.10	0.2956
10	0.701	204.9	3.10	0.2796
5	0.384	111.4	3.10	0.2409

Appendix

Table E.5: Resource and prompt-alignment measurements for the reduced diffusion-step experiment. Energy is estimated GPU board energy.

Figure E.1: Representative FARE patch evidence. Each row shows the model input, raw patch anomaly logits on a shared scale, and the logits overlaid on the input. White boxes mark the ten patches averaged by the image-level decision rule. The examples include the enrolled StyleGAN2 generator and substituted StyleGAN3, R3GAN, and ADM generators. The R3GAN image is accepted despite being a substitute, illustrating a false negative.

Train/cal. prompt split	Verification prompt split	TPR@1%FPR
“Animal”	Other prompts	97.83 $\pm$ 2.25
“Artifacts”	Other prompts	99.27 $\pm$ 1.03
“World-knowledge”	Other prompts	97.74 $\pm$ 1.40
“People”	Other prompts	98.68 $\pm$ 1.79

Appendix

Table F.1: Prompt-diversity robustness for Stable Diffusion. Results are reported as TPR@1%FPR under held-out prompt distributions

Item	Value
Software stack	Python 3.11.10, PyTorch 2.5.1, CUDA 12.1, torchvision 0.20.1, diffusers 0.37.0, transformers 5.3.0, scikit-learn 1.8.0, pandas 3.0.1
GPU	NVIDIA H200
Code release	https://github.com/kaikaiyao/FARE (core implementation)

Appendix

Table G.1: Reproduction details: software, hardware, and code publication

Digital Image Forensics

Digital image forensics develops methods to detect, localize, explain, and trace image manipulation, synthetic content, and hidden data.

See all 112 papers

FACT: A Forensic Agent with Compiled Tool-Use Trajectories for AI-Generated Image Detection
Sep 5, 2026Jiaoyang Chen, Bin Hu, Jingyu Hu +3AI-Generated Image Detection Image Forgery Detection
Lingnan University, Hong Kong · Harbin Institute of Technology, Shenzhen · The University of Hong Kong +2
SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data
Aug 13, 2026Yicheng Bao, Xiahui Guo, Xuhong Wang +1Adversarial Training Adversarial Examples
1East China Normal University · 2Shanghai Artificial Intelligence Laboratory
FAIR: Feature-Augmented Implicit Regularization for AI-generated Fake Image Detection
Jul 24, 2026Md Redwanul Haque, Manzur Murshed, Manoranjan Paul +1Domain Generalization AI-Generated Image Detection
Deakin University, Burwood, VIC, Australia · Charles Sturt University, Bathurst, NSW, Australia

Sep 5, 2026J/K move · Enter open · S save

FACT: A Forensic Agent with Compiled Tool-Use Trajectories for AI-Generated Image Detection

Jiaoyang Chen, Bin Hu, Jingyu Hu, Kun Zhou+2

Lingnan University, Hong Kong · Harbin Institute of Technology, Shenzhen · The University of Hong Kong+2

AI-Generated Image Detection Image Forgery Detection Digital Image Forensics Deepfake Detection

Open paper AskPDF arXiv

AI-generated image detection is increasingly open-world: new image generators produce highly realistic images that make visual artifacts harder to identify. Existing detectors usually rely on a fixed set of forensic cues, so a detector that works well for one generator family may fail on another. We introduce FACT (Forensic Agent with Compiled Tool-use Trajectories), which learns an image-conditioned tool-use policy for forensic analysis. Instead of applying a fixed detector, FACT decides which forensic tools to call, interprets the returned evidence, and stops when sufficient evidence has been collected. FACT follows an Evolve--Distill--Refine pipeline: it evolves an execution-verified forensic skill, compiles the skill into action--observation tool-use trajectories, distills them into a compact agent, and refines the policy with cost-aware GRPO. Across two internal and four public benchmarks, FACT achieves the best performance among all compared methods, including on recent unseen generators, deepfakes, and manipulated images.

Abstract

Digital Image Forensics

Explore similar work

FACT: A Forensic Agent with Compiled Tool-Use Trajectories for AI-Generated Image Detection

SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data

FAIR: Feature-Augmented Implicit Regularization for AI-generated Fake Image Detection