Detectors of AI-generated images are typically trained using samples from all Generative AI architectures they must catch, and struggle as soon as a new architecture emerges. Recent approaches have explored self-supervised pre-training as an alternative solution, yet standard frameworks work against the forensic task, e.g., their augmentations overwrite the micro-statistics of image formation. This paper introduces Forensic Twins, a Self-Supervised Residual Learning (SSRL) framework whose pretext task suppresses macroscopic content availability. Each image is mapped through a frozen, off-the-shelf forensic residual extractor, from which two spatially disjoint crops are drawn. Sharing no pixel, the two views retain minimal semantic structure to align, leaving a redundancy-reduction objective with a predominant common signal: the stationary fingerprint of the image acquisition pipeline. Additionally, Forensic Twins is trained exclusively on real images; no AI-generated image is observed at any stage. Experiments show that Forensic Twins attributes AI generator sources with 56.61% accuracy, i.e., 6.13% above the previous state-of-the-art zero-shot method at 375x lower latency. We also demonstrate that fitting a Gaussian Mixture Model (GMM) offline using only the real image embeddings extracted from Forensic Twins turns it into a state-of-the-art zero-shot detector, reaching 97.99% AUC across 27 unseen AI generators, including GANs, diffusion models and commercial systems. Code, weights and exact splits will be made publicly available
Figures & tables
Figure 1: Overview of Forensic Twins and applications. Top: Real RGB images ( X ) undergo non-destructive augmentations ( T ) and residual filtering ( F ). Then, two strictly disjoint crops ( R1,R2 ) pass through a ViT ( fθ ) and a projector ( gϕ ), trained with a redundancy-reduction objective on their cross-correlation matrix C . Bottom-left: a one-class GMM is fitted on frozen embeddings of real images ( Ztrain ) and scores each unseen test image ( Itest ) by −logP(Ztest) . Bottom-right: k -Means groups the frozen embeddings of an unlabeled real/AI-generated collection by image source.
Method
Real Only?
#Params
Lat. (ms)
GANs (8)
Diffusion (14)
Commercial (5)
Global (27)
CNNDet [CVPR20]
✗
23.5M
3.09
93.79
65.62
68.29
74.46
UFD [CVPR23]
✗
304.0M
8.28
97.73
83.60
84.80
88.01
LGrad [CVPR23]
✗
46.6M
10.43
78.52
62.90
53.96
65.87
NPR [CVPR24]
✗
1.4M
2.17
92.83
94.45
74.50
90.27
SPAI [CVPR25]
✗
139.9M
26.49
94.94
95.00
94.48
94.88
EFFORT [ICML25]
✗
504.6M
12.76
99.53
98.73
98.68
98.96
Table 1: AI-generated image detection performance (AUC %), averaged per category across 27 generative architectures and 2 real-image distributions (ImageNet-1k, MS-COCO). Parameter counts and latency are reproduced from the full cost breakdown in Appendix C (for Forensic Twins we include fre ’s module from ( Nguyen et al., 2025 ) in the computational cost and complexity statistics); latency is a median over 500 ImageNet-1k images on a single RTX 4090. Full per-generator breakdown in App. D . We also indicate whether the method was trained only with real images and the per-generator family average and the global average. Our results are in bold , top-3 models are underlined .
Method
# N
# 2 N
# 4 N
CLIP-L/14 [ICML21]
51.73
72.03
75.00
ConV [NeurIPS25]
43.98
54.16
65.95
FSD [CVPR25]
50.48
66.05
73.58
Ours
56.61
83.17
84.34
Table 2: Comparison for unsupervised clustering of image sources in terms of accuracy. The number of sources N is 8. Our results are in bold . Best result is underlined .
Figure 2: t-SNE visualization of images regarding semantic classes on ImageNet-1k (left) and different generators with different architectures (right). Note that Forensic Twins has never seen AI-generated images at training time; however, it is able to cluster them. The semantic visualization showcases mild aggregation per semantic class, but no clear structure.
Factor
Config
Changed value
GANs (8)
Diffusion (14)
Commercial (5)
Global
—
Base
—
51.76
66.14
61.13
60.95
Residual Extractor
Extractor
SRM
RGB → SRM
80.60
85.88
84.95
84.14
FRE
RGB → FRE
92.28
94.68
93.59
93.77
Augmentations (with FRE)
Img. Trans.
Destructive Aug.
Transformation Pipeline
59.56
57.91
54.90
57.84
Table 3: Ablation study of the encoder (491k training images, ImageNet-1k + MS-COCO) regarding the architecture and different optimization hyper-parameters changing one factor at a time. The factor composition contemplates ablations combining individual factors that improved the model performance in AI-generated image detection. Performance is shown in terms of AUC (%). We show the per-generator family average and the global average.
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
Decision rule
Fakes
Re-enc.
Native
QF95
QF80
QF65
QF50
QF35 †
GMM (paper)
✗
✗
97.99
71.93
66.35
63.78
59.92
61.63
GMM
✗
✓
93.50
80.85
70.63
71.46
71.18
64.10
k-NN ( N=400 )
✓
✗
99.27 ±0.09
79.34 ±2.48
71.86 ±4.64
56.88 ±6.24
63.05 ±6.25
56.84 ±10.6
k-NN ( N=400 )
✓
✓
99.03 ±0.17
94.26 ±0.40
95.26 ±0.24
94.00 ±0.19
92.22 ±0.36
58.95 ±15.5
k-NN, fakes ✓, re-enc. ✓: calibration size
N=10
97.63 ±0.91
89.23 ±3.85
90.32 ±2.91
87.67 ±2.40
85.69 ±1.30
81.91 ±14.4
Appendix
Table 4: Global AUC (%) under JPEG re-encoding of the test images. GMM rows are averaged over the 27 generators; k-NN rows over the 25 generators never selected for calibration (Guid.D and LDM excluded). Fakes : labelled fake images used to fit the decision rule, all from a single generator. Re-enc. : fitting images also included re-encoded (GMM: QF ∼U[50,100] ; k-NN: the same images at native, QF95, 80, 65, 50). k-NN rows: mean ±sd over 10 draws of the calibration set. † Outside the calibrated range. Bottom: calibration size N ( N real +N fake images, each at the 5 qualities); at N<400 , the generator selected in a draw is also excluded from that draw.
Semantic (7 superclasses) ↓
Source (7 generators) ↑
Method
Dim.
1-NN
5-NN
1-NN
5-NN
Δ
NPR
512
24.32 ± 0.66
26.57 ± 0.93
80.60 ± 0.88
81.04 ± 0.95
+56.28
FSD
960
34.17 ± 0.68
39.09 ± 1.32
80.65 ± 0.49
78.29 ± 0.71
+46.48
ConV
1024
99.35 ± 0.15
99.51 ± 0.12
78.35 ± 1.08
77.34 ± 0.72
− 21.00
EFFORT
1024
99.21 ± 0.19
99.39 ± 0.10
97.27 ± 0.21
97.38 ± 0.32
− 1.94
OmniAID
1024
99.29 ± 0.19
99.50 ± 0.11
95.15 ± 0.65
94.98 ± 0.55
− 4.14
Appendix
Table 5: Content-versus-source k -NN probe. Accuracy (%) of a cosine k -NN classifier on 7 ImageNet-1k superclasses ( semantic ) and on 7 generators ( source ), with 480 images per class, half used for fitting and half for evaluation. Mean ± standard deviation over 10 random splits; chance level is 14.29%. Δ is the 1-NN source accuracy minus the 1-NN semantic accuracy.
Figure 3: t-SNE comparison between 7 semantic classes from the ImageNet-1k dataset (left) and images from different generators, across GANs, Diffusion Models and Commercial Models (right) from Forensic Twins and different methods considered in Sec. 4.2 .
Method
Inference Type
#Params
GFLOPs ↓
Latency (ms) ↓
GPU (MB) ↓
CNNDet [CVPR20]
Forward (native res.)
23.5M
31.4
3.09
2230
UFD [CVPR23]
Forward
304.0M
162.0
8.28
2176
LGrad [CVPR23]
Forward + backward
46.6M
102.0
10.43
1006
SPAI [CVPR25]
Forward (native res.)
139.9M
656.8
26.49
8316
NPR [CVPR24]
Forward (native res.)
1.4M
12.9
2.17
2130
FSD [CVPR25]
Per-image solve
6.2M
2537.4
2415.27
12038
Appendix
Table 6: Computational cost of inference, measured on a fixed 500-image sample of ImageNet-1k – the same images for every column. GFLOPs and latency start from an input tensor that is already decoded and already preprocessed by each method’s own pipeline, so they isolate the detector from file I/O. Latency is a median over the 500 images on one RTX 4090; memory is the peak GPU footprint over the model’s whole lifetime.
Generative Adversarial Networks (GANs)
Method
ProGAN
SG2
SG3
BigGAN
StarGAN
EG3D
GauGAN
GigaGAN
Avg.
CNNDet Wang and others (2020)
100.00
96.21
94.54
87.07
93.22
95.70
98.14
72.61
92.19
UFD Ojha et al. (2023)
99.32
95.03
95.29
96.64
96.98
97.33
99.97
95.13
96.96
LGrad Tan et al. (2023)
96.05
89.36
91.91
63.72
48.99
84.49
84.73
78.55
79.73
NPR Tan et al. (2024)
99.58
99.51
99.53
82.95
58.64
99.60
99.18
98.20
92.15
SPAI Karageorgiou et al. (2025)
90.86
94.28
96.32
89.04
97.97
98.43
89.99
89.61
93.31
Appendix
Table 7: Comprehensive Zero-Shot Detection Performance (AUC %) across 27 distinct generative architectures using ImageNet-1k as real images. Results are evaluated using official pre-trained weights on identical test splits. Best result per column is underlined .
Generative Adversarial Networks (GANs)
Method
ProGAN
SG2
SG3
BigGAN
StarGAN
EG3D
GauGAN
GigaGAN
Avg.
CNNDet Wang and others (2020)
100.00
97.93
97.15
92.09
96.49
98.12
99.09
82.30
95.40
UFD Ojha et al. (2023)
99.78
97.52
97.51
98.16
98.47
99.08
100.00
97.42
98.49
LGrad Tan et al. (2023)
95.87
87.81
90.89
59.54
45.52
81.86
82.02
74.96
77.31
NPR Tan et al. (2024)
99.84
99.83
99.83
85.96
63.73
99.85
99.75
99.30
93.51
SPAI Karageorgiou et al. (2025)
95.01
97.34
98.48
93.78
99.39
99.56
94.58
94.32
96.56
Appendix
Table 8: Comprehensive Zero-Shot Detection Performance (AUC %) across 27 distinct generative architectures using MS-COCO as real images. Results are evaluated using official pre-trained weights on identical test splits. Best result per column is underlined .
Family
Conditioning
Content domain
Resolution
N
Sources
Generative Adversarial Networks
ProGAN
uncond.
LSUN (67%), CelebA-HQ (33%)
2562 (67%), 10242 (33%)
1000
DMID, SynthBuster, OSSIA
StyleGAN2
uncond.
FFHQ (62%), LSUN Dog (16%), AFHQv2 (13%), LSUN Church (9%)
10242 (45%), 2562 (42%), 5122 (13%)
1000
DMID, SynthBuster, OSSIA (incl. StyleGAN2-ADA)
StyleGAN3
uncond.
FFHQ / FFHQ-U (84%), AFHQv2 (16%); R and T configs
10242 (56%), 2562 (28%), 5122 (15%)
1000
DMID, SynthBuster, OSSIA
BigGAN
class / uncond.
ImageNet (79%), CelebA (21%, U-Net BigGAN)
2562 (60%), 5122 (40%)
1000
DMID, SynthBuster, OSSIA
StarGAN
i2i
Face attribute / style translation, CelebA-HQ (StarGAN, StarGAN v2)
2562
1000
SynthBuster, OSSIA
Appendix
Table 9: Generator families of the detection benchmark. Uncond. : unconditional sampling; class : class-conditional; text : text-to-image; layout : semantic-layout-to-image; i2i : image-to-image translation. COCO captions denotes prompts taken from MS-COCO validation captions. Resolution is width × height of the evaluated images; the proportion of each resolution or content domain within the family is given in parentheses. N is the number of evaluated images. n/s: content not specified by the source collection.
AI-generated image detection identifies synthetic or AI-edited images and develops methods that generalize across generators, domains, and image transformations.
AI-generated image detection is increasingly open-world: new image generators produce highly realistic images that make visual artifacts harder to identify. Existing detectors usually rely on a fixed set of forensic cues, so a detector that works well for one generator family may fail on another. We introduce FACT (Forensic Agent with Compiled Tool-use Trajectories), which learns an image-conditioned tool-use policy for forensic analysis. Instead of applying a fixed detector, FACT decides which forensic tools to call, interprets the returned evidence, and stops when sufficient evidence has been collected. FACT follows an Evolve--Distill--Refine pipeline: it evolves an execution-verified forensic skill, compiles the skill into action--observation tool-use trajectories, distills them into a compact agent, and refines the policy with cost-aware GRPO. Across two internal and four public benchmarks, FACT achieves the best performance among all compared methods, including on recent unseen generators, deepfakes, and manipulated images.
Jiaoyang Chen, Bin Hu, Jingyu Hu +3
Lingnan University, Hong Kong · Harbin Institute of Technology, Shenzhen · The University of Hong Kong +2
AI-generated image detectors achieve high accuracy on in-distribution data but often fail on unseen generators. A key obstacle to understanding this failure is the black-box nature of current detectors: they do not reveal which evidence drives their decisions. We propose ForensicConcept, a framework that extracts explicit forensic concepts from detectors and enables their transfer across backbones. Our method localizes decision-critical patches via Transformer attribution, clusters them into a compact concept codebook, and uses a concept-aligned projection to produce auditable evidence readouts. Motivated by prior studies showing that DINO representations can guide diffusion generation and exhibit concept-level correspondence with diffusion features, we introduce a generation-trace reference based on CleanDIFT diffusion features and quantify backbone-trace alignment via neighborhood-structure consistency (CKNNA). We further propose concept codebook injection to transfer diffusion-derived concepts into target backbones. Experiments on GenImage, GAN-family, and Chameleon benchmarks show consistent improvements over prior methods. We also find that CKNNA alignment predicts transfer effectiveness, providing a principled explanation for why some backbones yield more transferable forensic evidence than others.
Menyanshu Zhou, Ziyin Zhou, Ke Sun +4
Key Laboratory of Multimedia Trusted Perception and Efficient Computing, Ministry of Education of China, School of Informatics, Xiamen University, Xiamen 361005, P.R.China · Sino-Russian Research Center for Digital Economy
The rapid advancement of generative models has blurred the boundary between synthetic and real imagery, creating an urgent need for reliable deepfake detection. Yet most existing approaches rely on massive real--fake datasets, which are increasingly difficult to maintain as new generators continue to emerge. In this work, we investigate how much information about image authenticity is already encoded in modern multimodal vision representations. We find that frozen multimodal encoders naturally separate real and synthetic images in their embedding space, enabling a simple linear classifier to achieve strong performance without task-specific fine-tuning. Motivated by this observation, we develop a representation-aware data curation strategy that selects a compact set of representative generators for training. The resulting training set contains only 10K images, compared to 288K in AIGIBench and 4M in OpenFake, while improving robustness to unseen generators and distribution shifts. We additionally introduce RealWorldBench, a benchmark consisting of modern camera photographs, contemporary stock images, and outputs from recent commercial generators. Experiments across multiple benchmarks show that combining frozen multimodal representations with carefully curated training data provides a simple and effective approach to AI-generated image detection.