Rapid advances in image synthesis have increased the need for reliable synthetic-image detectors, yet their robustness to transferable attacks remains incomplete and understudied. Existing evaluations generally examine whether an attack constructed against one detector transfers to another, but rarely isolate how its effectiveness changes when the attacked images originate from different generators. We conduct a systematic evaluation of three representative attacks: two iterative perturbation-based methods, MIG and MuMoDIG, and the amortized generative attack Tricker. Across four detectors and five generators spanning diverse architectures, we introduce a two-axis evaluation protocol that independently varies the surrogate detector used to construct or train the attack and the generator supplying its input images. We assess attack effectiveness, cross-detector transferability, perceptual quality, runtime, and interaction with common post-processing operations. We revisit Tricker and show that its data and training requirements can be substantially reduced, enabling broader and more efficient evaluation. Our results demonstrate that transferability is not a detector-only property: the input-generator distribution strongly influences both evasion effectiveness and attacked-image quality. MIG and MuMoDIG exhibit pronounced dependence on the detector--generator pair, whereas Tricker provides more uniform white-box evasion and image quality. We additionally observe that post-processing maintains the asymmetric transferability topology. These findings expose a neglected dimension of attack evaluation and motivate transfer-aware protocols that jointly account for detector and generator variation. We will release our code, evaluation data, and trained attack models with a responsible-use statement.
Figures & tables
Figure 1: The effect of scaling the reconstruction term in the loss.
Figure 2: Ablation study for selecting the U-Net architecture.
Figure 3: Fake-image recall before attack (a) and under white-box attacks (b, c, d). Lower recall indicates stronger attack success. Color scales differ across panels to reveal low-recall differences.
Tricker
MIG
MuMoDIG
Detector
Training time (s/epoch)
Avg. epochs
Attack gen. time (ms)
Gen. time (s)
Break-even (# images)
Gen. time (s)
Break-even (# images)
D3
292
32.8
13.20
15.78
608
5.55
1730
GramNet
171
16.6
13.21
0.37
7956
0.49
5954
RINE
230
43.8
13.19
7.79
1296
2.16
4693
SPAI
602
19.4
13.19
8.85
1322
2.35
4998
Table 2: Runtime comparison across detectors and attack mechanisms.
Figure 4: Qualitative comparison of original and adversarial synthetic images. Tricker examples are generated using a model trained against RINE, while MIG and MuMoDIG perturbations are crafted using GramNet as the surrogate.
Figure 5: Average recall when Tricker is trained on all non-target source generators and evaluated on the held-out target generator for each detector.
Figure 6: Effect of the source generator on Tricker transferability. For each source generator, we evaluate Tricker on unseen target generators using the same detector. VQDM yields the strongest average transfer (a), while maintaining competitive image quality in terms of PSNR (b), SSIM (c), RMSE (d), LPIPS (e), and FID (f).
Figure 7: Cross-detector transferability. Rows are source detectors and columns are target detectors. Matrices reveal asymmetry.
Detector setting
Attack
JPEG–75
Blur σ=2
Downsample 0.5×
Upsample 2×
PP only
No attack
55.07
86.08
81.09
89.42
Detector matched Ds=Dt
Tricker
32.15
59.24
24.67
13.91
MIG
0.46
25.37
2.70
1.60
MuMoDIG
2.78
37.09
1.46
0.44
Detector transfer Ds=Dt
Tricker
54.78
80.98
71.11
72.47
MIG
46.37
77.82
49.46
45.01
Table 3: Post-processing in terms of mean fake-image recall (%). Cell backgrounds encode the recall change relative to the original detector-averaged recall, 90.36% : deeper blue denotes a larger recall reduction, gray denotes little change, and orange denotes an increase. Lower recall indicates stronger detector evasion. Colors represent total degradation relative to the original.
Appendix figures & tables4 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 8: SIDBench detectors recall without attack.
Figure 9: white-box attack PGD
Figure 10: Qualitative worst-case examples generated with D3.
Method applied before post-processing
Post- processing
Target detector Dt
D 3 [-1pt] R0=87.57%
GramNet [-1pt] R0=93.54%
RINE [-1pt] R0=95.98%
SPAI [-1pt] R0=84.34%
No attack
JPEG–75
63.18
0.48
72.87
83.75
Blur ( σ=2 )
74.12
98.67
78.87
92.66
Downsample ( 0.5× )
77.16
83.01
81.84
82.34
Upsample ( 2× , bicubic)
85.31
93.26
93.95
85.17
Tricker ( Ds=D3 )
JPEG–75
40.22
0.25
53.80
84.66
Appendix
Table 4: Fake-image recall after applying common post-processing. Results are grouped by attack family and surrogate detector. Cell colors are computed independently for each target detector relative to its original unprocessed recall R0 : values near R0 are gray, lower values become increasingly blue, and higher values become increasingly red. Lower recall indicates stronger detector evasion.
The impressive visual quality and ubiquity of AI-generated images call for reliable and robust detection methods. Reconstruction-based detectors have emerged as a promising direction for transparent and training-free identification of synthetic images. However, due to their fundamentally different mode of operation (compared to standard, classifier-based methods), little is known about their adversarial robustness. In this work, we propose two novel attack methods targeted at detectors that leverage autoencoder reconstruction error. We find that by constructing imperceptible adversarial examples, the distance between original and reconstruction can be artificially increased, causing fake images to be wrongly classified as real. Our evaluation including images from three state-of-the-art generators and three detectors demonstrates that detection performance is significantly decreased, even if attacked images additionally undergo real-world degradations. Critically, our adversarial examples naturally transfer across detectors, as they all share the same principle, pointing towards an inherent vulnerability of reconstruction-based detectors.
Recent image generators produce photo-realistic content that undermines the reliability of downstream recognition systems. As visual appearance cues become less pronounced, appearance-driven detectors that rely on forensic cues or high-level representations lose stability. This motivates a shift from appearance to behavior, focusing on how images respond to controlled perturbations rather than how they look. In this work, we identify a simple and universal behavioral signal. Natural images preserve stable semantic representations under small, structured perturbations, whereas generated images exhibit markedly larger feature drift. We refer to this phenomenon as robustness asymmetry and provide a theoretical analysis that establishes a lower bound connecting this asymmetry to memorization tendencies in generative models, explaining its prevalence across architectures. Building on this insight, we introduce Robustness Asymmetry Detection (RA-Det), a behavior-driven detection framework that converts robustness asymmetry into a reliable decision signal. Evaluated across 14 diverse generative models and against more than 10 strong detectors, RA-Det achieves superior performance, improving the average performance by 7.81 percent. The method is data- and model-agnostic, requires no generator fingerprints, and transfers across unseen generators. Together, these results indicate that robustness asymmetry is a stable, general cue for synthetic-image detection and that carefully designed probing can turn this cue into a practical, universal detector. The source code is publicly available at Github.
The rapid advancement of generative artificial intelligence (AI) has made synthetic images remarkably realistic, posing security threats such as misinformation and fraud. It is significant to detect the synthetic image in the manner of passive and blind image authentication. Most existing detectors rely on supervised training with large labeled datasets, leading to high costs and degraded performance on unknown generative models. To attenuate such deficiencies, we propose a training-free detection method. Specifically, noise residual fingerprints are first extracted by a simple yet effective pre-trained Noiseprint++ model. Then multi-scale features are further extracted from such residual by a frozen Vision Transformer (ViT), followed by adaptive weighted fusion. Only a few real image samples are used needed to initialize the clustering centers for unsupervised K-Means, distinguishing real and synthetic images without training. Extensive evaluations on four benchmark datasets show that our proposed scheme achieves an average accuracy of 82.2%, outperforming the state-of-the-art detectors on generalization ability. Superior performance is gained on the popular diffusion type of synthetic images, and the effectiveness of each module is validated by ablation studies. Source code will be publicly available at https://github.com/multimediaFor/NoiseCluSID.
Caihui Yan, Gang Cao, Huawei Tian +2
School of Computer and Cyber Sciences, Communication University of China, Beijing 100024, China · People's Public Security University of China, Beijing 100038, China