Can Pixels Alone Reveal Image Origin? Minimax Limits and Learnable Interfaces for Passive Provenance

Kai Yao

cs.CRSep 25, 2026

Can Pixels Alone Reveal Image Origin? Minimax Limits and Learnable Interfaces for Passive Provenance

Authors: Kai Yao

Organizations: School of Informatics University of Edinburgh

Abstract

Passive image provenance asks whether pixels alone can reveal where an image came from: a human, an aggregate AI class, or a particular generator. This becomes a robustness problem once a source image can be edited before the verifier sees it. We study the problem as source--target verification under adversarial distribution shift. Our first result gives the exact best-case limit for any image-only verifier: the largest robust target-acceptance gap equals the minimum total-variation distance between the target distribution and the set of attacked source distributions. This quantity depends on the source, target, and edit class, not on the verifier architecture. Our second result explains why deployed public verifiers can fail before this statistical limit is reached. If the verifier can be emulated on the attack region to error $\varepsilon$ , then a surrogate black-box attack reaches target acceptance within $2\varepsilon$ plus optimization error of the white-box optimum; score-revealing logistic and softmax heads over public features are identifiable, and approximate score access gives stable recovery bounds. A finite-state experiment checks the minimax identity where both sides are computable. On same-prompt real/diffusion benchmarks, the evaluated public CLIP verifiers fail under targeted pixel attacks, while a ResNet-18 victim exhibits partial fake-to-real transfer. Binary feedback with abstention reduces measured attack success, but positive empirical gap upper bounds do not establish robustness. These results motivate separate evaluation of the source--target statistical ceiling and the information released by a deployed verifier.

Figures & tables

Figure 1: Controlled public CLIP-softmax verifier on the same-prompt three-class benchmark. Score-revealing queries recover the deployed score function; attacks on the recovered verifier approach white-box performance; all four source–target directions collapse; and every estimated gap upper bound is negative on the evaluated samples.

Verifier	Full vector	Single score	Top-1 label	Binary verdict	Binary + abstain
Linear softmax CLIP head	1.00	0.91	0.75	1.00	0.00
Two-layer MLP CLIP head	1.00	0.93	1.00	1.00	0.00
Off-the-shelf CLIP detector	1.00	1.00	1.00	–	0.09

Table 1: Representative

8/255

interface slice on the expanded five-class benchmark. Entries are ASR; a dash denotes an unevaluated combination. Plain binary feedback remains attackable for both learned heads. Binary feedback with abstention uses the configured per-split cap

7{,}200

and reduces ASR across these three systems.

Model	Acc.	AUC	Min ASR $2/255$	Min ASR $8/255$	Best gap $2/255$	Worst gap $8/255$
Released	0.517	0.887	0.890	1.000	$-0.026$	$-0.081$
Clean retrain	0.869	0.982	0.967	1.000	$-0.169$	$-0.364$
Adv. retrain	0.821	0.947	0.900	1.000	$-0.024$	$-0.185$

Table 2: Released and retrained models on the original three-class benchmark. Clean columns report test accuracy and fake AUC; attack columns summarize the minimum ASR, maximum (best) gap, or minimum (worst) gap across the four evaluated source–target directions at the indicated budget.

Figure 2: Paired examples at an $\ell_{\infty}$ budget of $2/255$ . Each triplet shows the clean image, the attacked image, and the signed perturbation amplified eightfold around mid-gray. The SD1.5 $\to$ SDXL example induces target acceptance, while the SDXL $\to$ SD1.5 example fails. These selected examples illustrate both outcomes.

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Queries	Score error	Rec.-WB gap	Recovered ASR
128	$3.03\times 10^{-3}$	0.0363	1.000
256	$1.89\times 10^{-3}$	0.0192	1.000
512	$1.01\times 10^{-3}$	0.0162	1.000
1,024	$1.26\times 10^{-3}$	0.0052	1.000
2,048	$6.88\times 10^{-8}$	0.0030	1.000
7,200	$5.60\times 10^{-8}$	0.0028	1.000

Appendix

Table 3: Exact-recovery details for the controlled public CLIP-softmax baseline on the three-class benchmark. The table supports Section 7.1 by showing that score emulation becomes operationally white-box by 2,048 queries.

Direction	Budget	ASR	$\bm{\widetilde{\mathrm{Gap}}}$	Clean target acc.	Adv. target score
Human $\to$ AI	$2/255$	1.0000	$-0.0387$	0.6786	0.7173
Human $\to$ AI	$4/255$	1.0000	$-0.0522$	0.6786	0.7308
Human $\to$ AI	$8/255$	1.0000	$-0.0628$	0.6786	0.7414
AI $\to$ Human	$2/255$	1.0000	$-0.0420$	0.3338	0.3758
AI $\to$ Human	$4/255$	1.0000	$-0.0592$	0.3338	0.3930
AI $\to$ Human	$8/255$	1.0000	$-0.0755$	0.3338	0.4094

Appendix

Table 4: Per-direction targeted attacks for the original controlled public CLIP-softmax verifier on the three-class benchmark. This table supports the negative-gap claim in Section 7.1 : all four source–target directions reach ASR

1.0

8/255

, and every empirical gap upper bound is negative.

Verifier	Acc.	Macro-F1	Fake AUC	TPR@5%FPR	EER	Role
Binary logistic on CLIP	0.8007	0.4479	0.8470	0.4033	0.2288	Shared-representation linear baseline
Intercept softmax on CLIP	0.5053	0.4782	0.9054	0.5217	0.1608	Shared-representation linear variant
One-vs-rest logistic on CLIP	0.5980	0.5871	0.9338	0.6433	0.1371	Shared-representation linear variant
Temperature-scaled softmax on CLIP	0.4827	0.4491	0.9286	0.7133	0.1525	Shared-representation linear variant
Linear softmax head on CLIP	0.5667	0.5734	0.9289	0.6608	0.1438	Main-text linear representative
Two-layer MLP on CLIP	0.6280	0.6071	0.9717	0.8333	0.0883	Main-text nonlinear representative

Appendix

Table 5: Clean matrix on the expanded five-class benchmark. This table supports the setup of Section 7.2 : the three representative CLIP-based systems have meaningful clean performance, while CNNSpot and DIRE are included as weak off-the-shelf controls rather than as main robustness claims.

Interface	ASR	$\bm{\widetilde{\mathrm{Gap}}}$	$\bm{\epsilon_{95}}$	ASR	$\bm{\widetilde{\mathrm{Gap}}}$	$\bm{\epsilon_{95}}$	ASR	$\bm{\widetilde{\mathrm{Gap}}}$	$\bm{\epsilon_{95}}$
	Linear softmax on CLIP			Two-layer MLP on CLIP			Off-the-shelf CLIP detector
Full score vector	1.0000	$-0.0356$	0.0051	1.0000	$-0.0598$	0.0054	1.0000	$-0.5515$	0.2824
Single fake score	0.9100	$-0.0098$	0.3314	0.9300	$-0.0200$	0.3137	1.0000	$-0.5405$	0.3476
8-bit fake score	0.9233	$-0.0100$	0.3196	0.9733	$-0.0209$	0.3313	–	–	–
Top-1 label only	0.7533	$-0.0076$	1.0000	1.0000	$-0.0380$	1.0000	1.0000	$-0.5512$	1.0000
Binary verdict	1.0000	$-0.0260$	0.7056	1.0000	$-0.0498$	0.7004	–	–	–

Appendix

Table 6: Representative interface slice at

8/255

on the expanded five-class benchmark. This table is the detailed version of Table 1 : columns report ASR, the empirical gap upper bound

\widetilde{\mathrm{Gap}}

, and the

95

th-percentile emulator error

\epsilon_{95}

. Here

q

is a per-split transcript cap, yielding

\min(q,3000)

training and

\min(q,1500)

validation replies. Dashes denote model–interface combinations not evaluated in this sweep.

Figure 3: Heatmap summary of the representative $8/255$ interface slice. This visual counterpart to Table 6 shows that richer interfaces remain fragile and that positive empirical gap upper bounds first appear only under binary feedback with abstention.

Cap $q$	Train replies	Val. replies	Binary ASR	$\bm{\widetilde{\mathrm{Gap}}}$	$\bm{\epsilon_{95}}$
128	128	128	1.0000	$-0.0249$	0.6846
512	512	512	1.0000	$-0.0253$	0.7159
2,048	2,048	1,500	1.0000	$-0.0263$	0.7098
7,200	3,000	1,500	1.0000	$-0.0258$	0.7025

Appendix

Table 7: Binary-feedback transcript-cap sweep for the linear softmax CLIP head on the expanded five-class benchmark. The cap is reset for each split; the actual reply counts are shown separately. Without abstention, ASR remains

1.0

and estimated gap upper bounds remain negative.

Queries	Linear softmax	Two-layer MLP
128	0.3438	0.1562
512	0.4062	0.1875
2,048	0.4062	0.2500
7,200	0.4062	0.3125

Appendix

Table 8: Score-guided random-search sanity check. Entries are threshold-crossing success rates when continuous target scores guide proposal retention. This control reports neither a robust-gap estimate nor binary-only private-oracle performance.

Direction	Budget	ASR	$\bm{\widetilde{\mathrm{Gap}}}$	Clean target acc.	Adv. target score
Human $\to$ AI	$2/255$	1.0000	$-0.0576$	0.6807	0.7383
Human $\to$ AI	$4/255$	1.0000	$-0.0938$	0.6807	0.7745
Human $\to$ AI	$8/255$	1.0000	$-0.1236$	0.6807	0.8042
AI $\to$ Human	$2/255$	0.9000	$-0.0483$	0.3730	0.4213
AI $\to$ Human	$4/255$	0.9817	$-0.0809$	0.3730	0.4539
AI $\to$ Human	$8/255$	1.0000	$-0.1141$	0.3730	0.4872

Appendix

Table 9: Per-direction targeted attacks for the adversarially trained three-class model. This table supports Section 7.3 : relative to the released checkpoint, clean performance improves substantially, but the model still fails under the same source–target attack directions.

Sample size $n$	Mean absolute error
250	0.02094
1,000	0.01008
5,000	0.00451

Appendix

Table 10: Finite-state plug-in estimation of the attackability radius. Mean absolute error is aggregated over 20 source–target/edit-radius settings and 20 repeats per setting. The population attack-side and verifier-side optima agree to a maximum absolute discrepancy of

4.44\times 10^{-16}

Direction	Overall ASR	Initially-correct ASR (count)	$\bm{\widetilde{\mathrm{Gap}}}$
Fake $\to$ Real	43.75%	38.46% (45/117)	$+0.5375$
Real $\to$ Fake	0.78%	0.00% (0/122)	$+0.9093$

Appendix

Table 11: Transfer from a CLIP-feature emulator to an RGB ResNet-18 victim at

\ell_{\infty}=8/255

. Each direction contains 128 held-out sources. The initially-correct column excludes clean misclassifications and reports the number of induced target predictions. Positive empirical gap estimates do not certify positive robust separation.

Budget	Induced ASR (count)	Median SSIM range	Median LPIPS-Alex range
$2/255$	90.0% (45/50)	0.9781–0.9849	0.0050–0.0081
$8/255$	100.0% (50/50)	0.8011–0.8534	0.0770–0.1365

Appendix

Table 12: Paired image quality on the controlled benchmark. Each budget contains 64 attack instances, including 14 pre-existing target-side predictions. Induced ASR uses the remaining 50 initially correct instances. SSIM and LPIPS-Alex ranges are the minimum and maximum of the four direction-specific medians, each calculated over all 16 instances in that direction, rather than over successful attacks alone.

Figure 4: Selected paired examples in four attack directions at an $\ell_{\infty}$ budget of $2/255$ . Columns show the clean image, the attacked image, and the signed perturbation amplified eightfold around mid-gray. The first three rows are induced successes and the SDXL $\to$ SD1.5 row is an attack failure. Figure 5 uses the same clean images at $8/255$ .

Figure 5: The same four clean images as in Figure 4 , attacked at an $\ell_{\infty}$ budget of $8/255$ . All four selected examples are induced successes. The paired views and amplified signed perturbations illustrate the larger changes at this budget; they do not establish human imperceptibility or semantic preservation.

Adversarial Attacks on AI-Generated Image Detectors

See all 11 papers

SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data
Aug 13, 2026Yicheng Bao, Xiahui Guo, Xuhong Wang +1Adversarial Training Adversarial Examples
1East China Normal University · 2Shanghai Artificial Intelligence Laboratory
PROVE: Training-Free Prompt Recovery using Verifiable Evidence
Aug 13, 2026Rupayan Mallick, Mahsa Khoshnoodi, Sarah Adel Bargal
Department of Computer Science, Georgetown University
Soft Redaction of Image Provenance via Zero-Knowledge Proofs
Aug 7, 2026Muhammad Awan, John CollomosseData Provenance Zero-Knowledge Proofs
University of Surrey, Guildford GU2 7XH, UK · Adobe Research, San Jose CA 95110, USA

Aug 13, 2026J/K move · Enter open · S save

SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data

Yicheng Bao, Xiahui Guo, Xuhong Wang, Xin Tan

1East China Normal University · 2Shanghai Artificial Intelligence Laboratory

Adversarial Training Adversarial Examples AI-Generated Image Detection Adversarial Attacks on AI-Generated Image Detectors

Open paper AskPDF arXiv

Detecting AI-generated images is only half the task: a deployed detector must also justify its verdict, yet existing detectors inherit three failure modes from their training data: real and fake images collected from different sources invite provenance shortcuts, supervised explanation corpora teach templated rationales, and a static forgery corpus leaves the decision boundary standing still while generators keep moving. We introduce \methodname{}, an adversarial reinforcement learning framework that pits two heterogeneous models against each other. A diffusion image editor learns to edit real photographs into fake counterparts of those same photographs that fool the current detector, while a reasoning MLLM learns to expose them with a verdict grounded in free-form reasoning. Both rewards are shortcut-proof by design: the attacker is credited only when its edit is faithfully executed, and the defender only when its verdict is correct. As the two models alternate, each round's attacker regenerates a harder training pool aimed at the current detector's blind spots, so the detector must generalize rather than memorize any fixed artifact distribution. Although the explanation is never rewarded, its quality rises round over round as a side effect of accuracy-only training. A detector trained within this loop improves monotonically across rounds on each of three external benchmarks.

Abstract

Adversarial Attacks on AI-Generated Image Detectors

Explore similar work

SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data

PROVE: Training-Free Prompt Recovery using Verifiable Evidence

Soft Redaction of Image Provenance via Zero-Knowledge Proofs