Images produced by generative models appear strikingly similar to real ones. In this work, we study whether perfection has been reached by generated content in terms of matching the properties of real data. We train deep neural networks to separate real data from fake and observe their test accuracies. Only a chance performance has any scope of proving statistical indistinguishability. However, since generative models are known to sometimes introduce small errors, e.g., low level checkerboard artifacts, we create progressive abstractions of the original real/fake images to potentially bring them to a space where those artifacts get wiped away. These include operations such as blurring, downsizing, cropping, converting RGB images into edge/semantic maps, etc. To our surprise, almost none of the abstractions are able to make fake data indistinguishable from real. The only cases when neural network based classifiers fail to separate the two categories is when the data is abstracted to such an extent that the original content seems mostly lost to the human eye, e.g., downsizing a 256×256 RGB image of human face to 4×4 resolution. We observe this trend across four different datasets of varying complexity (MNIST, CelebA, FFHQ and GenImage) and across various types of generative models (GANs, VAEs, diffusion models). This shows that the nature of fake artifacts extends all the way from low level to very high level in images. The simple implication is that fake images are much more different from real than we are used to think.
Figures & tables
Figure 1: The first column corresponds to a classifier being trained to distinguish clean real (top) and fake images (bottom), achieving a high test accuracy because of the presence of artifacts. In each subsequent column, we transform the original images with the hope of masking away the artifact signal; e.g., downsizing (DS) to 16×16 (6th column). When new classifiers are trained for each column, the accuracy still remains high. For true statistical indistinguishability ( ∼50% ; last two columns), we need to abstract away most of the image content by, e.g., downsizing to 4×4 resolution.
Figure 2: Left : even when visually mild abstractions such as blur, Gaussian noise, uniform noise, quantization, or brightness shifts are applied, binary neural classifiers can still separate real and fake MNIST samples with high test accuracy. Right : toy examples contrasting the desired i.i.d. case, R,F∼S , with a non-i.i.d. shifted fake distribution, F=R+δ , where the two sample sets are visually close but statistically structured differently.
Figure 3: Motivation for image abstractions. Left: fake FFHQ images may contain localized artifacts, such as unnatural skin, that disappear after mapping the image to a higher-level semantic segmentation representation. Right: CelebA examples show a spatial abstraction, where downsampling removes fine image details while preserving coarse facial structure. We apply such abstractions to both real and fake images and test whether classifiers can still distinguish f(R) from f(F) .
Figure 4: MNIST real-vs-fake detection under image abstractions. Columns show clean and corrupted versions of matched real and ACGAN-generated digits, while the heatmap reports the best test accuracy across DenseNet-Small, Mini-Xception, and ResNet-Small. Real and fake images remain separable through many abstractions and approach chance only when the digit content is heavily destroyed. Please see Table 6 for corruption configurations.
Figure 5: FFHQ real (top) and StyleGAN2, VD VAE, LDM-generated faces under various data abstractions. Even after abstracting away enough information from real and fake images, e.g., by converting them into semantic mask, we do not observe statistical indistinguishability, as a classifiers trained from scratch are able to obtain accuracies way above 50% in Table 1 .
Model
Downsizing
Cropping
Blurring
64×64
16×16
4×4
1×1
64×64
16×16
4×4
1×1
σ=5
σ=10
σ=20
σ=40
StyleGAN2
99.8%
86.2%
58.4%
52.6%
100%
99.8%
96.3%
54.8%
98.0%
93.0%
74.0%
63.0%
VD VAE
98.9%
91.9%
69.3%
57.0%
100%
99.8%
85.9%
57.8%
95.8%
93.2%
83.0%
73.6%
LDM
99.5%
73.7%
58.1%
54.7%
100%
99.6%
82.5%
55.5%
93.0%
79.6%
64.8%
59.1%
Table 1: FFHQ real-vs-fake test accuracy of the best performing classifier under various data abstractions for StyleGAN2, VD VAE and LDM. Detection remains high for many spatially degraded inputs and approaches chance only under the strongest abstractions, such as 1×1 spatial collapse.
Edge
Mask
Keypoint
Eye
Nose
Mouth
L-eye
R-brow
R-ear
StyleGAN2
91.7%
76.1%
78.3%
99.8%
99.9%
99.9%
99.2%
98.9%
99.0%
VD VAE
95.0%
70.3%
76.5%
99.9%
99.9%
99.9%
99.9%
99.9%
99.9%
LDM
99.8%
67.8%
75.0%
99.9%
100.0%
100.0%
99.9%
99.9%
99.9%
Table 2: FFHQ real-vs-fake test accuracy of best performing classifier for StyleGAN2, VD VAE and LDM across various data abstractions (first 3 columns) and cropped face parts (last 6 columns).
Figure 6: Real (top) and fake images (bottom three) from GenImage dataset under different spatial and blur abstractions. The original images are of 256×256 resolution. Even after abstracting the information content to a great extent by downsizing, blurring or compressing, the resulting real and fake images are still distinguishable by a classifier trained from scratch, as shown in Table 3 .
Model
Downsizing
Cropping
Blurring
JPEG
16×16
4×4
1×1
16×16
4×4
1×1
σ=10
σ=20
σ=40
50
25
5
Wukong
90.9%
81.1%
66.7%
97.5%
66.2%
61.9%
91.4%
87.2%
83.9%
96.6%
96.0%
92.6%
SD v1.4
91.1%
80.9%
68.6%
76.1%
61.5%
58.7%
91.1%
87.5%
82.4%
97.5%
94.8%
75.9%
SD v1.5
89.7%
80.2%
67.8%
75.6%
61.2%
58.4%
89.9%
86.0%
81.2%
96.9%
95.8%
91.1%
Midjourney
78.4%
69.1%
58.7%
93.2%
73.5%
57.4%
81.2%
74.7%
70.3%
92.7%
90.2%
84.3%
Table 3: GenImage real-vs-fake test accuracy under downsampling, cropping, blurring and JPEG abstractions. Detection remains well above chance for most abstractions and approaches chance only under extreme spatial collapse, such as 1×1 downsampling or cropping.
Appendix figures & tables14 assets
Supplementary material from the paper’s appendix.
Appendix
Resource
Description
Usage
Compute environment
Institutional HPC cluster managed with SLURM.
On-premise HPC
Accelerators
NVIDIA GPU nodes scheduled from the pool, including A100, A40, Titan RTX, Titan X, Titan V, and GTX 1080 Ti GPUs.
1 GPU per run
CPU and memory
Standard training allocation used by the reported experiments.
4 CPU cores, 16 GB RAM
Storage
Cluster data filesystem used for datasets, checkpoints, generated samples, logs, and analysis outputs.
personal env
Software environment
Conda environment with PyTorch and torchvision; jobs launched through SLURM scripts.
Python/PyTorch
Appendix
Table 4: Compute environment used for the experiments.
Model
Architecture
Parameters
ResNet-Small
3×3 convolution stem with 16 channels, followed by three residual stages: two 16 -channel residual blocks, two 32 -channel residual blocks with stride- 2 downsampling in the first block, and two 64 -channel residual blocks with stride- 2 downsampling in the first block. Each residual block uses two 3×3 convolutions with batch normalization and ReLU, plus an identity or 1×1 projection shortcut. Final adaptive average pooling and a linear sigmoid head.
174,945
DenseNet-Small
DenseNet-BC style network with growth rate k=12 , initial 3×3 convolution to 24 channels, three dense blocks with four dense layers per block, and transition layers between blocks. Each dense layer uses BN–ReLU– 1×1 convolution followed by BN–ReLU– 3×3 convolution, then concatenates features with the input. Final batch normalization, adaptive average pooling, and a linear sigmoid head.
101,479
Mini-Xception
Compact Xception-style network. Entry block: 1→8 channels via a 3×3 convolution, batch normalization, and ReLU. Three residual depthwise-separable blocks with channel sizes 16 , 32 , and 64 ; the first two downsample by a factor of 2 . Final adaptive average pooling and a linear sigmoid head.
13,089
Appendix
Table 5: Binary classifier architectures used for the MNIST real-vs-fake abstraction experiments.
Figure 7: MNIST real-vs-fake detection under image abstractions. Columns show clean and corrupted versions of matched real and ACGAN-generated digits, while the heatmap reports test accuracy for DenseNet-Small (DNet), Mini-Xception (XCP), and ResNet-Small (RNet). Real and fake images remain separable through many abstractions and approach chance only when the digit content is heavily destroyed. Please see Table - 6 for corruption configurations.
#
Operation
0
clean
1
blur σ=3.0
2
gauss σ=0.5
3
quant L=2
4
unif a=0.5
5
brightness b=+0.95
Appendix
Table 6: The 25 abstraction configurations used for the main MNIST experiment.
Name
Optimizer
Params
Description
Baseline CNN
Adadelta 1.0
7,392,449
The model uses two convolutional layers, mapping 3 channels to 32 and then 32 to 64 , followed by max pooling and dropout with probability 0.25 . The flattened features pass through a 128 -unit fully connected layer, dropout with probability 0.5 , and a final one-unit output layer.
CNN+BatchNorm
Adam 10−3
7,392,641
Baseline with BatchNorm after each conv; dropout removed.
Table 7: Architectures used in the CelebA experiments.
Figure 8: PCA results for CelebA/DcGAN configuration
Figure 9: CelebA real and DCGAN-generated faces under spatial and blur abstractions.
Model
Downsizing
Cropping
Blurring
16×16
4×4
2×2
1×1
10×10
4×4
2×2
1×1
σ=6
σ=10
σ=20
σ=30
Constrained CNN
99.7%
90.2%
68.9%
53.9%
100.0%
99.9%
94.6%
57.1%
97.3%
91.7%
93.4%
96.2%
DenseNet
99.5%
89.0%
68.2%
54.0%
100.0%
100.0%
94.6%
57.1%
98.2%
91.0%
90.6%
91.2%
SRNet
99.8%
90.5%
68.4%
54.1%
100.0%
99.9%
94.5%
57.1%
96.4%
84.1%
83.6%
86.5%
Appendix
Table 8: CelebA real-vs-fake test accuracy under downsampling, cropping, and blurring abstractions. Each entry reports binary classification accuracy on held-out real and DCGAN-generated test images. Detection remains well above chance for most abstractions and approaches chance only under extreme spatial collapse, such as 1×1 downsampling or cropping.
Table 9: Architectures used in the FFHQ experiments. Parameter counts are given for 1-channel (derived representations) and 3-channel (raw RGB) inputs.
Figure 10: FFHQ real and StyleGAN2-generated faces under semantic and local-part abstractions.
Figure 11: FFHQ real and StyleGAN2-generated faces under spatial and blur abstractions.
Model
Downsizing
Cropping
Blurring
64×64
16×16
4×4
1×1
64×64
16×16
4×4
1×1
σ=5
σ=10
σ=20
σ=40
ResNet
99.1%
67.2%
54.5%
52.6%
100.0%
99.7%
81.7%
54.7%
96.5%
76.9%
57.0%
55.2%
DenseNet
99.5%
77.6%
55.5%
52.5%
100.0%
99.8%
96.3%
54.8%
96.7%
82.3%
66.8%
59.6%
ViT
99.8%
86.2%
58.4%
51.3%
100.0%
99.8%
95.1%
50.5%
98.0%
93.0%
74.0%
63.0%
Appendix
Table 10: FFHQ real-vs-fake test accuracy under downsampling, cropping, and blurring abstractions. Each entry reports binary classification accuracy on held-out real and StyleGAN2-generated test images. Detection remains high for many spatially degraded inputs and approaches chance only under the strongest abstractions, such as 1×1 spatial collapse.
Edge
Mask
Eye
Nose
Mouth
L-eye
R-brow
R-ear
ResNet
82.4%
71.1%
99.69%
99.28%
99.85%
98.97%
98.59%
74.97%
DenseNet
85.9%
76.1%
99.84%
99.90%
99.71%
99.24%
97.19%
86.19%
ViT
91.7%
70.9%
99.83%
99.78%
99.77%
98.34%
98.88%
98.95%
Appendix
Table 11: Real-vs-fake test accuracy on FFHQ vs. StyleGAN2 across derived representations (Edge, Mask) and six cropped face parts.
Figure 12: Real (top) and fake images (bottom three) from GenImage dataset under different spatial and blur abstractions.
The rapid advancement of generative models has made the detection of AI-generated images a critical challenge for both research and society. Recent works have shown that most state-of-the-art fake image detection methods overfit to their training data and catastrophically fail when evaluated on curated hard test sets with strong distribution shifts. In this work, we argue that it is more principled to learn a tight decision boundary around the real image distribution and treat the fake category as a sink class. To this end, we propose SimLBR, a simple and efficient framework for fake image detection using Latent Blending Regularization (LBR). Our method significantly improves cross-generator generalization, achieving up to +24.85% accuracy and +69.62% recall on the challenging Chameleon benchmark. SimLBR is also highly efficient, training orders of magnitude faster than existing approaches. Furthermore, we emphasize the need for reliability-oriented evaluation in fake image detection, introducing risk-adjusted metrics and worst-case estimates to better assess model robustness. All code and models will be released on HuggingFace and GitHub.
Aayush Dhakal, Subash Khanal, Srikumar Sastry +4
Washington University in St. Louis · Oak Ridge National Laboratory
Fake/synthetic images are increasingly prevalent, but it remains unclear whether Convolutional Neural Networks (CNNs) process real and fake images in the same internal manner. This work examines the hypothesis that CNNs represent real and fake images differently, such that fake images induce different hidden-layer activation patterns even when semantic content is preserved. The hypothesis is evaluated in scene recognition settings using trained CNN models. Dense-layer activations are extracted, and neurosymbolic methods assign semantic labels to selected neurons. For each real test image, corresponding fake images are generated with similar semantic content using object-label-guided text-to-image and image-to-image generation based on Stable Diffusion variants. Paired real-fake activation patterns are then compared statistically. Additional experiments with another dataset, CNN architecture, generative model, and JPEG/blur degradation analysis assess robustness. Results suggest that fake images evoke different hidden-neuron activations, and these differences are not explained only by simple image degradation. Overall, the findings indicate that real and fake images differ in CNN hidden-layer activation behavior at least in some settings, which opens the door for follow-up work on making use of this different behavior to improve fake image detection.
Moumita Sen Sarma, Pascal Hitzler, Eugene Y. Vasserman
Department of Computer Science, Kansas State University, Manhattan, Kansas, USA
Diffusion models are able to produce AI-generated images that are almost indistinguishable from real ones. This raises concerns about their potential misuse and poses substantial challenges for detecting them. Many existing detectors rely on reconstruction error -- the difference between the input image and its reconstructed version -- as the basis for distinguishing real from fake images. However, these detectors become less effective as modern AI-generated images become increasingly similar to real ones. To address this challenge, we propose a novel difference-in-difference method. Instead of directly using the reconstruction error (a first-order difference), we compute the difference in reconstruction error -- a second-order difference -- for variance reduction and improving detection accuracy. Extensive experiments demonstrate that our method achieves strong generalization performance, enabling reliable detection of AI-generated images in the era of generative AI.
Xinyi Qi, Kai Ye, Chengchun Shi +3
The London School of Economics and Political Science · University of Birmingham