AI-generated images have reached unprecedented realism, while instruction-driven AI editors re-synthesize images for local changes, leaving no splice boundary to localize. Most detectors are black boxes with unverifiable verdicts and generalize poorly because adapting a backbone on the detection distribution memorizes generator-specific fingerprints that quickly become obsolete. Specialist detectors built on pure-vision representations, particularly DINOv3, generalize well across generators, but explainable methods forgo this advantage: jointly training one multimodal model for classification and language generation subjects its visual representation to the language objective. We therefore require that explanation training cannot alter the verdict. We introduce FOX, which first builds and locks a specialist DINOv3 detector, then uses its representation to guide a lightweight VLM toward forensic explanation. A joint-embedding predictor maps locked visual evidence into a frozen text encoder's semantic space, producing guidance that the VLM verbalizes on demand. FOX achieves 97.4 mean AUC across 14 unseen generators, 69.8 BERTScore on XPlainVerse, and 56.1 on LOKI.
Figures & tables
Figure 2: Training of FOX. Detection and explanation are optimized separately. Stage 1 adapts the X-Encoder through LoRA jointly with the Classifier under cross-entropy; Stage 2 trains the Predictor with InfoNCE against the frozen Y-Encoder . Stage 3 trains a LoRA on the decoder (3a), the query module together with the Predictor (3b), and the residual adapter (3c).
Figure 3: Qualitative explanations produced by FOX. For each detected fake: input image ( left ), the explanation produced by the guided Y-Decoder ( center ), and the ground-truth forensic annotation ( right ).
Stable Diffusion
Midjourney
DALL-E
GPT
Other
Approach
SD2
SDXL
SD3
MJv5
MJv6.1
MJ7
DALLE2
DALLE3
GPT-I2
GPT-I1.5
Flux
GigaGAN
Firefly
NB-Pro
Mean
DeFake [ 98 ]
76.3
84.5
95.6
83.5
86.4
81.9
68.1
94.8
82.6
80.0
95.5
58.9
84.5
71.1
81.7
PatchCr. [ 122 ]
95.5
96.3
32.5
78.0
95.7
94.8
80.0
28.5
59.5
78.7
67.2
86.9
78.2
59.7
73.7
RINE [ 69 ]
83.6
86.5
30.7
75.7
67.7
63.7
75.6
72.3
29.4
42.7
68.1
93.4
70.7
33.5
63.8
SPAI [ 64 ]
93.3
94.0
61.2
97.4
80.4
83.7
83.2
81.1
63.7
78.0
80.0
92.9
87.6
60.8
81.2
B-Free [ 46 ]
100.0
100.0
92.7
99.9
96.2
92.7
98.8
99.5
73.1
66.8
93.9
96.4
99.9
96.7
93.3
Table 1: Detection performance on unseen generators. AUC ( ×100 ) on 14 unseen generators. Best per column in bold , second best underlined , with ties bolded jointly. The XPV ows indicate retraining on XPlainVerse.
XPlainVerse
LOKI
Approach
R-L
CSS
BERTSc.
R-L
CSS
BERTSc.
SIDA [ 57 ]
15.7
40.4
52.3
19.2
40.9
53.4
FakeVLM [ 111 ]
17.0
47.1
57.0
17.4
51.4
55.8
LEGION [ 62 ] †
n/a
n/a
n/a
18.5
45.9
n/a
FOX (Stage 3a only)
25.5
59.9
65.3
17.1
48.9
52.1
FOX (proposed)
27.5
62.2
69.8
20.1
52.0
56.1
Table 2: Explanation performance comparison. ROUGE-L (R-L), CSS [ 62 ] , and BERTScore F1 [ 119 ] ( ×100 ). † No public LEGION detection checkpoint is available, entries are from [ 62 ] .
Figure 4: Robustness to common perturbations. AUC ( ×100 ) of FOX and representative baselines under increasing severity of JPEG compression, WebP compression, downscaling, additive Gaussian noise, and blur.
Backbone
SD1.5
BigGAN
VQDM
MJv4
Wuk
Mean
Language-supervised
CLIP [ 93 ]
88.6
90.9
93.2
81.9
86.1
88.1
SigLIP [ 117 ]
89.7
86.8
84.4
80.3
91.5
86.5
AIMv2 [ 32 ]
84.9
86.6
82.8
85.4
88.5
85.6
Pure-vision, generative or predictive
MAE [ 49 ]
83.1
84.2
87.6
85.5
83.1
84.7
Table 3: Ablation on backbone choice. Frozen backbones share the same downstream readout and are evaluated on five unseen GenImage generators.
DINOv3
XPV
Cham.
GenImage
Frozen
99.4
79.9
98.8
LoRA
99.9
83.6
97.6
LoRA + int. val. (XPV)
99.9
82.6
95.0
LoRA + ext. val. (Cham.) (ours)
99.9
97.2
99.7
Table 4: Ablation on backbone adaptation. We compare freezing, end-of-epoch LoRA
Variant
AUC (Unseen)
BERTSc.
Training organization
Single end-to-end pipeline
93.4
68.9
Decoupled detector + explainer (ours)
97.4
72.1
Representation sharing
Shared trunk, early stop
96.9
68.9
Shared trunk, late stop
94.5
69.5
Table 5: Ablation on training design. Joint versus separate optimization and shared versus disjoint trunks.
Weighting
Global
Collapse
BERTSc.
Cos. sim. ↓
retention
resistance
NLL
No
No
68.5
99.9
NLL
No
Yes
69.3
35.7
Uniform
Yes
Yes
70.2
68.4
NLL
Yes
Yes
72.1
31.1
Table 6: Ablation on query training. . Cosine similarity is the mean pairwise similarity between query vectors ( ×100 ); lower values indicate less query collapse.
Stage 3: Configuration
BERTSc.
Stage 3a: image + verdict: VLM ablation
PaliGemma-2-3B Mix
66.3
InternVL2.5-4B
66.2
Qwen2.5-VL-3B (selected)
69.1
Qwen2.5-VL-3B explanation pathway
Stage 3a + 3c, no queries
69.3
Table 7: Ablation on the explanation. Top: VLM backbone. Bottom: progressive conditioning with Qwen2.5-VL-3B fixed.
Stage 3b: Query slots
BERTSc.
1 slot
69.3
2 slots
69.9
4 slots (ours)
72.1
8 slots
70.1
4 slots, shuffled across images
68.9
Table 8: Ablation on query set size. We vary the number of slots while fixing the remaining explanation pathway.
Appendix figures & tables14 assets
Supplementary material from the paper’s appendix.
Appendix
Module
Initialization
Total
Trained
Stage
Detection pathway
X-Encoder
DINOv3 ViT-L/16
307M
–
–
LoRA ( r=32 , s=64 )
zero
3.15M
3.15M
1
Classifier
scratch
25.20M
25.20M
1
Explanation pathway
Predictor
scratch
25.72M
25.72M
2, 3b
Appendix
Table B.1: Parameters of FOX. Trained parameters by pathway and stage.
Stage
Optimizer
Learning rate
Weight decay
Effective batch
Duration
1
AdamW
1×10−4
1×10−2
16×4=64
1 epoch
2
SAM–AdamW
3×10−4
5×10−2
2048
24 epochs
3a
AdamW
1×10−4
1×10−2
4×8=32
1 epoch
3b
AdamW
3×10−4
1×10−2
128
15 epochs
3c
AdamW
1×10−4
1×10−2
4×8=32
1 epoch
Appendix
Table C.1: Optimization settings for the five sequential training steps. Products in the effective-batch column denote physical batch size times gradient accumulation.
Generation source
Examples
Share
Gemini-2.0-Flash
354,256
98.40%
ICEdit
3050
0.85%
GPT-Image-1
2694
0.75%
Total
360,000
100.00%
Appendix
Table D.1: Generator composition of the synthetic XPV training data. Percentages are relative to the 360000 synthetic examples.
Reported
Protocol / source
Generators or real-image sources
Total images
Main
SPAI protocol [ 64 ]
From Synthbuster [ 8 ] : SD2 (1000), SDXL (1000), MJv5 (1000), DALLE2 (1000), DALLE3 (1000), and Firefly (1000). From [ 72 ] : Flux (1000). From [ 97 ] : MJv6.1 (638). From [ 37 ] : SD3 (1000). From [ 63 ] : GigaGAN (1000)
9638
Main
OpenFake [ 80 ]
MJ7 (1000), GPT-I2 (474), GPT-I1.5 (1000), and NB-Pro (386)
2860
Appendix
SPAI protocol [ 64 ]
From Synthbuster [ 8 ] : GLIDE (1000), SD1.3 (1000), and SD1.4 (1000)
Table D.2: Detection evaluation inventory. Parentheses give the number of evaluated images. Rows marked SPAI protocol are not drawn from a single released benchmark: we follow the collection protocol of [ 64 ] and gather images from its specified sources. OpenFake [ 80 ] is a released benchmark. The main paper reports 14 generators; the appendix adds 19. The same 5 real sources are used in both evaluations.
Method
All 33
Post-Jun. (21)
Post-Dec. (14)
SPAI XPV
82.2
82.7
82.5
RINE XPV
85.6
86.0
83.7
B-Free XPV
91.6
90.5
88.8
DINO-MAC XPV
91.5
88.0
85.6
FOX
96.1
94.8
93.4
Appendix
Table E.1: Temporal generalization. Mean AUC ( ×100 ) across 33 generators and subsets released after Chameleon’s publication (June 2024) and dataset release (December 2024). All methods share the XPV training and Chameleon checkpoint-selection protocol.
Readout
Params
GenImage
Cham
Linear
0.05M
98.6
68.9
Transformer-2L
18.90M
98.9
76.3
Transformer-4L
25.20M
98.8
79.9
Transformer-8L
37.81M
98.7
79.6
Appendix
Table F.1: How much readout capacity does the comparison need? AUC with a frozen DINOv3 ViT-L/16 and only the readout varied, trained on XPlainVerse and tested on unseen generators. GenImage averages five unseen GenImage generators (SD1.5, BigGAN, VQDM, MJv4, Wukong); Chameleon is reported separately. Parameter counts correspond to the 6144 -dimensional DINOv3 readout.
Predictor initialization
BERTSc.
Random init. (no Stage 2)
68.3
Stage 2 semantic pretraining (ours)
72.1
Appendix
Table F.2: Effect of semantic predictor pretraining. The two variants differ only in the initialization used at the beginning of Stage 3b.
Stage 2: Objective
BERTSc.
Cosine regression
65.6
InfoNCE (ours)
72.1
Appendix
Table F.3: Ablation on the predictor objective. Direct cosine regression is compared with contrastive embedding prediction.
Off-the-shelf
Retrained XPV
Generator
DeFake
PatchCraft
RINE
SPAI
B-Free
FakeVLM
SIDA
SPAI
RINE
B-Free
DINO-MAC
FOX
Stable Diffusion
SD1.3
88.6
95.7
91.4
99.0
100.0
69.5
80.7
80.6
82.0
97.1
99.9
100.0
SD1.4
88.9
95.7
91.5
99.0
100.0
70.9
81.2
81.2
82.0
97.2
99.9
100.0
SD2
76.3
95.5
83.6
93.3
100.0
64.8
61.2
77.7
83.8
90.8
99.1
99.3
SDXL
84.4
96.3
86.5
94.0
100.0
58.4
87.5
92.0
98.5
92.3
99.9
100.0
Appendix
Table H.1: Detection performance on the full generator suite. AUC ( ×100 ) on all 33 generators. Best per row in bold , second best underlined , with ties marked jointly. Off-the-shelf baselines are DeFake [ 98 ] , PatchCraft [ 122 ] , RINE [ 69 ] , SPAI [ 64 ] , B-Free [ 46 ] , FakeVLM [ 111 ] and SIDA [ 57 ] ; the XPV columns retrain SPAI, RINE, B-Free and DINO-MAC on our training split. The OpenFake group collects generators sourced from the OpenFake benchmark [ 80 ] ; none of them, and none of the other generators here, appear in any training split used in this work.
Off-the-shelf
Retrained XPV
Generator
DeFake
PatchCraft
RINE
SPAI
B-Free
FakeVLM
SIDA
SPAI
RINE
B-Free
DINO-MAC
FOX
Stable Diffusion
SD1.3
79.8
85.6
81.6
84.8
98.9
50.4
71.7
60.6
70.7
94.9
96.9
99.8
SD1.4
80.5
85.2
81.7
84.8
98.9
50.4
72.6
61.0
71.2
95.1
96.3
99.7
SD2
68.7
85.4
76.1
81.6
98.9
50.2
57.5
59.9
72.9
90.0
77.8
87.2
SDXL
76.8
87.9
78.8
83.3
99.0
50.2
79.2
81.3
86.4
95.7
97.5
99.5
Appendix
Table H.2: Accuracy at a fixed threshold of 0.5 on the full generator suite. Accuracy ( ×100 ) on all 33 generators. Best per row in bold , second best underlined , with ties bolded jointly. Off-the-shelf baselines are DeFake [ 98 ] , PatchCraft [ 122 ] , RINE [ 69 ] , SPAI [ 64 ] , B-Free [ 46 ] , FakeVLM [ 111 ] and SIDA [ 57 ] ; the XPV columns retrain SPAI, RINE, B-Free and DINO-MAC on our training split. The OpenFake group collects generators sourced from the OpenFake benchmark [ 80 ] ; none of them, and none of the other generators here, appear in any training split used in this work.
Off-the-shelf
Retrained XPV
Generator
DeFake
PatchCraft
RINE
SPAI
B-Free
FakeVLM
SIDA
SPAI
RINE
B-Free
DINO-MAC
FOX
Stable Diffusion
SD1.3
88.0
96.2
90.3
98.1
100.0
70.3
82.0
77.2
85.1
97.2
99.9
100.0
SD1.4
88.3
96.3
90.1
98.1
100.0
71.1
82.4
77.9
85.0
97.2
99.9
100.0
SD2
76.0
95.9
80.7
93.3
100.0
68.6
64.5
76.0
86.7
95.9
99.1
99.2
SDXL
84.6
94.7
84.0
92.9
100.0
60.2
89.6
92.3
98.8
97.3
99.9
100.0
Appendix
Table H.3: Average precision on the full generator suite. AP ( ×100 ) on all 33 generators. Best per row in bold , second best underlined , with ties bolded jointly. Off-the-shelf baselines are DeFake [ 98 ] , PatchCraft [ 122 ] , RINE [ 69 ] , SPAI [ 64 ] , B-Free [ 46 ] , FakeVLM [ 111 ] and SIDA [ 57 ] ; the XPV columns retrain SPAI, RINE, B-Free and DINO-MAC on our training split. The OpenFake group collects generators sourced from the OpenFake benchmark [ 80 ] ; none of them, and none of the other generators here, appear in any training split used in this work.
Figure H.1: FOX generalizes to unseen, recent generators without retraining. Each row pairs two examples from one generator with the verdict and explanation produced by FOX. None of the five generators were seen during training, and all verdicts shown are correct.
Figure H.2: Correct, forensically grounded explanations from FOX across the BERTScore distribution on XPV. The rotated label gives the ground-truth class; FOX predicts the correct verdict in all four cases. The two rows per class are drawn from the high and low ends of the BERTScore distribution.
Figure H.3: Representative failure modes of FOX on XPV. The rotated label gives the ground-truth class and the predicted class; the verdict is wrong in all four cases. The two rows per direction are drawn from the high and low ends of the BERTScore distribution among wrong verdict predictions.
AI-generated image detection identifies synthetic or AI-edited images and develops methods that generalize across generators, domains, and image transformations.
Detecting AI-generated images is only half the task: a deployed detector must also justify its verdict, yet existing detectors inherit three failure modes from their training data: real and fake images collected from different sources invite provenance shortcuts, supervised explanation corpora teach templated rationales, and a static forgery corpus leaves the decision boundary standing still while generators keep moving. We introduce \methodname{}, an adversarial reinforcement learning framework that pits two heterogeneous models against each other. A diffusion image editor learns to edit real photographs into fake counterparts of those same photographs that fool the current detector, while a reasoning MLLM learns to expose them with a verdict grounded in free-form reasoning. Both rewards are shortcut-proof by design: the attacker is credited only when its edit is faithfully executed, and the defender only when its verdict is correct. As the two models alternate, each round's attacker regenerates a harder training pool aimed at the current detector's blind spots, so the detector must generalize rather than memorize any fixed artifact distribution. Although the explanation is never rewarded, its quality rises round over round as a side effect of accuracy-only training. A detector trained within this loop improves monotonically across rounds on each of three external benchmarks.
Yicheng Bao, Xiahui Guo, Xuhong Wang +1
1East China Normal University · 2Shanghai Artificial Intelligence Laboratory
AI-generated image detection is increasingly open-world: new image generators produce highly realistic images that make visual artifacts harder to identify. Existing detectors usually rely on a fixed set of forensic cues, so a detector that works well for one generator family may fail on another. We introduce FACT (Forensic Agent with Compiled Tool-use Trajectories), which learns an image-conditioned tool-use policy for forensic analysis. Instead of applying a fixed detector, FACT decides which forensic tools to call, interprets the returned evidence, and stops when sufficient evidence has been collected. FACT follows an Evolve--Distill--Refine pipeline: it evolves an execution-verified forensic skill, compiles the skill into action--observation tool-use trajectories, distills them into a compact agent, and refines the policy with cost-aware GRPO. Across two internal and four public benchmarks, FACT achieves the best performance among all compared methods, including on recent unseen generators, deepfakes, and manipulated images.
Jiaoyang Chen, Bin Hu, Jingyu Hu +3
Lingnan University, Hong Kong · Harbin Institute of Technology, Shenzhen · The University of Hong Kong +2
AI-generated image detectors achieve high accuracy on in-distribution data but often fail on unseen generators. A key obstacle to understanding this failure is the black-box nature of current detectors: they do not reveal which evidence drives their decisions. We propose ForensicConcept, a framework that extracts explicit forensic concepts from detectors and enables their transfer across backbones. Our method localizes decision-critical patches via Transformer attribution, clusters them into a compact concept codebook, and uses a concept-aligned projection to produce auditable evidence readouts. Motivated by prior studies showing that DINO representations can guide diffusion generation and exhibit concept-level correspondence with diffusion features, we introduce a generation-trace reference based on CleanDIFT diffusion features and quantify backbone-trace alignment via neighborhood-structure consistency (CKNNA). We further propose concept codebook injection to transfer diffusion-derived concepts into target backbones. Experiments on GenImage, GAN-family, and Chameleon benchmarks show consistent improvements over prior methods. We also find that CKNNA alignment predicts transfer effectiveness, providing a principled explanation for why some backbones yield more transferable forensic evidence than others.
Menyanshu Zhou, Ziyin Zhou, Ke Sun +4
Key Laboratory of Multimedia Trusted Perception and Efficient Computing, Ministry of Education of China, School of Informatics, Xiamen University, Xiamen 361005, P.R.China · Sino-Russian Research Center for Digital Economy