Generalizable AI-Generated Image Detection with Embedding-Space Explanations

Nikos Giakoumoglou; Paschalis Giakoumoglou; Tania Stathaki; Symeon Papadopoulos

cs.CVNov 3, 2026

Generalizable AI-Generated Image Detection with Embedding-Space Explanations

Authors: Nikos Giakoumoglou, Paschalis Giakoumoglou, Tania Stathaki, Symeon Papadopoulos

Organizations: Imperial College London · Information Technologies Institute, CERTH

Abstract

AI-generated images have reached unprecedented realism, while instruction-driven AI editors re-synthesize images for local changes, leaving no splice boundary to localize. Most detectors are black boxes with unverifiable verdicts and generalize poorly because adapting a backbone on the detection distribution memorizes generator-specific fingerprints that quickly become obsolete. Specialist detectors built on pure-vision representations, particularly DINOv3, generalize well across generators, but explainable methods forgo this advantage: jointly training one multimodal model for classification and language generation subjects its visual representation to the language objective. We therefore require that explanation training cannot alter the verdict. We introduce FOX, which first builds and locks a specialist DINOv3 detector, then uses its representation to guide a lightweight VLM toward forensic explanation. A joint-embedding predictor maps locked visual evidence into a frozen text encoder's semantic space, producing guidance that the VLM verbalizes on demand. FOX achieves 97.4 mean AUC across 14 unseen generators, 69.8 BERTScore on XPlainVerse, and 56.1 on LOKI.

Figures & tables

Figure 2: Training of FOX. Detection and explanation are optimized separately. Stage 1 adapts the X-Encoder through LoRA jointly with the Classifier under cross-entropy; Stage 2 trains the Predictor with InfoNCE against the frozen Y-Encoder . Stage 3 trains a LoRA on the decoder (3a), the query module together with the Predictor (3b), and the residual adapter (3c).

Panel of Figure 3 — Figure 3: Qualitative explanations produced by FOX. For each detected fake: input image ( left ), the explanation produced by the guided Y-Decoder ( center ), and the ground-truth forensic annotation ( right ).

Approach	SD2	SDXL	SD3	MJv5	MJv6.1	MJ7	DALLE2	DALLE3	GPT-I2	GPT-I1.5	Flux	GigaGAN	Firefly	NB-Pro	Mean
	Stable Diffusion			Midjourney			DALL-E		GPT		Other
DeFake [ 98 ]	76.3	84.5	95.6	83.5	86.4	81.9	68.1	94.8	82.6	80.0	95.5	58.9	84.5	71.1	81.7
PatchCr. [ 122 ]	95.5	96.3	32.5	78.0	95.7	94.8	80.0	28.5	59.5	78.7	67.2	86.9	78.2	59.7	73.7
RINE [ 69 ]	83.6	86.5	30.7	75.7	67.7	63.7	75.6	72.3	29.4	42.7	68.1	93.4	70.7	33.5	63.8
SPAI [ 64 ]	93.3	94.0	61.2	97.4	80.4	83.7	83.2	81.1	63.7	78.0	80.0	92.9	87.6	60.8	81.2
B-Free [ 46 ]	100.0	100.0	92.7	99.9	96.2	92.7	98.8	99.5	73.1	66.8	93.9	96.4	99.9	96.7	93.3

Table 1: Detection performance on unseen generators. AUC (

\times 100

) on 14 unseen generators. Best per column in bold , second best underlined , with ties bolded jointly. The XPV ows indicate retraining on XPlainVerse.

	XPlainVerse			LOKI
Approach	R-L	CSS	BERTSc.	R-L	CSS	BERTSc.
SIDA [ 57 ]	15.7	40.4	52.3	19.2	40.9	53.4
FakeVLM [ 111 ]	17.0	47.1	57.0	17.4	51.4	55.8
LEGION [ 62 ] †	n/a	n/a	n/a	18.5	45.9	n/a
FOX (Stage 3a only)	25.5	59.9	65.3	17.1	48.9	52.1
FOX (proposed)	27.5	62.2	69.8	20.1	52.0	56.1

Table 2: Explanation performance comparison. ROUGE-L (R-L), CSS [ 62 ] , and BERTScore F1 [ 119 ] (

\times 100

). † No public LEGION detection checkpoint is available, entries are from [ 62 ] .

Figure 4: Robustness to common perturbations. AUC (

\times 100

) of FOX and representative baselines under increasing severity of JPEG compression, WebP compression, downscaling, additive Gaussian noise, and blur.

Language-supervised
Backbone	SD1.5	BigGAN	VQDM	MJv4	Wuk	Mean
CLIP [ 93 ]	88.6	90.9	93.2	81.9	86.1	88.1
SigLIP [ 117 ]	89.7	86.8	84.4	80.3	91.5	86.5
AIMv2 [ 32 ]	84.9	86.6	82.8	85.4	88.5	85.6
Pure-vision, generative or predictive
MAE [ 49 ]	83.1	84.2	87.6	85.5	83.1	84.7

Table 3: Ablation on backbone choice. Frozen backbones share the same downstream readout and are evaluated on five unseen GenImage generators.

DINOv3	XPV	Cham.	GenImage
Frozen	99.4	79.9	98.8
LoRA	99.9	83.6	97.6
LoRA + int. val. (XPV)	99.9	82.6	95.0
LoRA + ext. val. (Cham.) (ours)	99.9	97.2	99.7

Table 4: Ablation on backbone adaptation. We compare freezing, end-of-epoch LoRA

Training organization
Variant	AUC (Unseen)	BERTSc.
Single end-to-end pipeline	93.4	68.9
Decoupled detector + explainer (ours)	97.4	72.1
Representation sharing
Shared trunk, early stop	96.9	68.9
Shared trunk, late stop	94.5	69.5

Table 5: Ablation on training design. Joint versus separate optimization and shared versus disjoint trunks.

Weighting	Global	Collapse	BERTSc.	Cos. sim. $\downarrow$
Weighting	retention	resistance	BERTSc.	Cos. sim. $\downarrow$
NLL	No	No	68.5	99.9
NLL	No	Yes	69.3	35.7
Uniform	Yes	Yes	70.2	68.4
NLL	Yes	Yes	72.1	31.1

Table 6: Ablation on query training. . Cosine similarity is the mean pairwise similarity between query vectors (

\times 100

); lower values indicate less query collapse.

Stage 3: Configuration	BERTSc.
Stage 3a: image + verdict: VLM ablation
PaliGemma-2-3B Mix	66.3
InternVL2.5-4B	66.2
Qwen2.5-VL-3B (selected)	69.1
Qwen2.5-VL-3B explanation pathway
Stage 3a + 3c, no queries	69.3

Table 7: Ablation on the explanation. Top: VLM backbone. Bottom: progressive conditioning with Qwen2.5-VL-3B fixed.

Stage 3b: Query slots	BERTSc.
$1$ slot	69.3
$2$ slots	69.9
$4$ slots (ours)	72.1
$8$ slots	70.1
$4$ slots, shuffled across images	68.9

Table 8: Ablation on query set size. We vary the number of slots while fixing the remaining explanation pathway.

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

Module	Initialization	Total	Trained	Stage
Detection pathway
X-Encoder	DINOv3 ViT-L/16	307M	–	–
LoRA ( $r{=}32$ , $s{=}64$ )	zero	3.15M	3.15M	1
Classifier	scratch	25.20M	25.20M	1
Explanation pathway
Predictor	scratch	25.72M	25.72M	2, 3b

Appendix

Table B.1: Parameters of FOX. Trained parameters by pathway and stage.

Stage	Optimizer	Learning rate	Weight decay	Effective batch	Duration
1	AdamW	$1\times 10^{-4}$	$1\times 10^{-2}$	$16\times 4=64$	1 epoch
2	SAM–AdamW	$3\times 10^{-4}$	$5\times 10^{-2}$	$2048$	24 epochs
3a	AdamW	$1\times 10^{-4}$	$1\times 10^{-2}$	$4\times 8=32$	1 epoch
3b	AdamW	$3\times 10^{-4}$	$1\times 10^{-2}$	$128$	15 epochs
3c	AdamW	$1\times 10^{-4}$	$1\times 10^{-2}$	$4\times 8=32$	1 epoch

Appendix

Table C.1: Optimization settings for the five sequential training steps. Products in the effective-batch column denote physical batch size times gradient accumulation.

Generation source	Examples	Share
Gemini-2.0-Flash	354,256	98.40%
ICEdit	3050	0.85%
GPT-Image-1	2694	0.75%
Total	360,000	100.00%

Appendix

Table D.1: Generator composition of the synthetic XPV training data. Percentages are relative to the 360000 synthetic examples.

Reported	Protocol / source	Generators or real-image sources	Total images
Main	SPAI protocol [ 64 ]	From Synthbuster [ 8 ] : SD2 (1000), SDXL (1000), MJv5 (1000), DALLE2 (1000), DALLE3 (1000), and Firefly (1000). From [ 72 ] : Flux (1000). From [ 97 ] : MJv6.1 (638). From [ 37 ] : SD3 (1000). From [ 63 ] : GigaGAN (1000)	9638
Main	OpenFake [ 80 ]	MJ7 (1000), GPT-I2 (474), GPT-I1.5 (1000), and NB-Pro (386)	2860
Appendix	SPAI protocol [ 64 ]	From Synthbuster [ 8 ] : GLIDE (1000), SD1.3 (1000), and SD1.4 (1000)	3000
Appendix	OpenFake [ 80 ]	Aurora-20-1-25 (282), ERNIE-Image (315), ERNIE-Image-Turbo (687), FLUX.2-Klein-9B (1000), Frames-23-1-25 (250), Halfmoon-4-4-25 (190), Ideogram-2.0 (282), Illustrious (1000), Lumina-17-2-25 (543), Recraft-v2 (282), Recraft-v3 (1000), Seedream-v5.0 (372), Sora-2 (557), Veo-3 (1000), Wan-Video-2.5 (1000), and Z-Image-Turbo (1000)	9760
Both	SPAI protocol [ 64 ]	RAISE [ 25 ] (1000), FODB [ 48 ] (1000), ImageNet [ 26 ] (1000), COCO [ 76 ] (1000), and OpenImages [ 71 ] (1000)	5000

Appendix

Table D.2: Detection evaluation inventory. Parentheses give the number of evaluated images. Rows marked SPAI protocol are not drawn from a single released benchmark: we follow the collection protocol of [ 64 ] and gather images from its specified sources. OpenFake [ 80 ] is a released benchmark. The main paper reports 14 generators; the appendix adds 19. The same 5 real sources are used in both evaluations.

Method	All 33	Post-Jun. (21)	Post-Dec. (14)
SPAI XPV	82.2	82.7	82.5
RINE XPV	85.6	86.0	83.7
B-Free XPV	91.6	90.5	88.8
DINO-MAC XPV	91.5	88.0	85.6
FOX	96.1	94.8	93.4

Appendix

Table E.1: Temporal generalization. Mean AUC (

\times 100

) across 33 generators and subsets released after Chameleon’s publication (June 2024) and dataset release (December 2024). All methods share the XPV training and Chameleon checkpoint-selection protocol.

Readout	Params	GenImage	Cham
Linear	0.05M	98.6	68.9
Transformer-2L	18.90M	98.9	76.3
Transformer-4L	25.20M	98.8	79.9
Transformer-8L	37.81M	98.7	79.6

Appendix

Table F.1: How much readout capacity does the comparison need? AUC with a frozen DINOv3 ViT-L/16 and only the readout varied, trained on XPlainVerse and tested on unseen generators. GenImage averages five unseen GenImage generators (SD1.5, BigGAN, VQDM, MJv4, Wukong); Chameleon is reported separately. Parameter counts correspond to the

6144

-dimensional DINOv3 readout.

Predictor initialization	BERTSc.
Random init. (no Stage 2)	68.3
Stage 2 semantic pretraining (ours)	72.1

Appendix

Table F.2: Effect of semantic predictor pretraining. The two variants differ only in the initialization used at the beginning of Stage 3b.

Stage 2: Objective	BERTSc.
Cosine regression	65.6
InfoNCE (ours)	72.1

Appendix

Table F.3: Ablation on the predictor objective. Direct cosine regression is compared with contrastive embedding prediction.

Stable Diffusion
	Off-the-shelf							Retrained XPV
Generator	DeFake	PatchCraft	RINE	SPAI	B-Free	FakeVLM	SIDA	SPAI	RINE	B-Free	DINO-MAC	FOX
SD1.3	88.6	95.7	91.4	99.0	100.0	69.5	80.7	80.6	82.0	97.1	99.9	100.0
SD1.4	88.9	95.7	91.5	99.0	100.0	70.9	81.2	81.2	82.0	97.2	99.9	100.0
SD2	76.3	95.5	83.6	93.3	100.0	64.8	61.2	77.7	83.8	90.8	99.1	99.3
SDXL	84.4	96.3	86.5	94.0	100.0	58.4	87.5	92.0	98.5	92.3	99.9	100.0

Appendix

Table H.1: Detection performance on the full generator suite. AUC (

\times 100

) on all 33 generators. Best per row in bold , second best underlined , with ties marked jointly. Off-the-shelf baselines are DeFake [ 98 ] , PatchCraft [ 122 ] , RINE [ 69 ] , SPAI [ 64 ] , B-Free [ 46 ] , FakeVLM [ 111 ] and SIDA [ 57 ] ; the XPV columns retrain SPAI, RINE, B-Free and DINO-MAC on our training split. The OpenFake group collects generators sourced from the OpenFake benchmark [ 80 ] ; none of them, and none of the other generators here, appear in any training split used in this work.

Stable Diffusion
	Off-the-shelf							Retrained XPV
Generator	DeFake	PatchCraft	RINE	SPAI	B-Free	FakeVLM	SIDA	SPAI	RINE	B-Free	DINO-MAC	FOX
SD1.3	79.8	85.6	81.6	84.8	98.9	50.4	71.7	60.6	70.7	94.9	96.9	99.8
SD1.4	80.5	85.2	81.7	84.8	98.9	50.4	72.6	61.0	71.2	95.1	96.3	99.7
SD2	68.7	85.4	76.1	81.6	98.9	50.2	57.5	59.9	72.9	90.0	77.8	87.2
SDXL	76.8	87.9	78.8	83.3	99.0	50.2	79.2	81.3	86.4	95.7	97.5	99.5

Appendix

Table H.2: Accuracy at a fixed threshold of 0.5 on the full generator suite. Accuracy (

\times 100

) on all 33 generators. Best per row in bold , second best underlined , with ties bolded jointly. Off-the-shelf baselines are DeFake [ 98 ] , PatchCraft [ 122 ] , RINE [ 69 ] , SPAI [ 64 ] , B-Free [ 46 ] , FakeVLM [ 111 ] and SIDA [ 57 ] ; the XPV columns retrain SPAI, RINE, B-Free and DINO-MAC on our training split. The OpenFake group collects generators sourced from the OpenFake benchmark [ 80 ] ; none of them, and none of the other generators here, appear in any training split used in this work.

Stable Diffusion
	Off-the-shelf							Retrained XPV
Generator	DeFake	PatchCraft	RINE	SPAI	B-Free	FakeVLM	SIDA	SPAI	RINE	B-Free	DINO-MAC	FOX
SD1.3	88.0	96.2	90.3	98.1	100.0	70.3	82.0	77.2	85.1	97.2	99.9	100.0
SD1.4	88.3	96.3	90.1	98.1	100.0	71.1	82.4	77.9	85.0	97.2	99.9	100.0
SD2	76.0	95.9	80.7	93.3	100.0	68.6	64.5	76.0	86.7	95.9	99.1	99.2
SDXL	84.6	94.7	84.0	92.9	100.0	60.2	89.6	92.3	98.8	97.3	99.9	100.0

Appendix

Table H.3: Average precision on the full generator suite. AP (

\times 100

Panel of Figure 23 — Figure H.1: FOX generalizes to unseen, recent generators without retraining. Each row pairs two examples from one generator with the verdict and explanation produced by FOX. None of the five generators were seen during training, and all verdicts shown are correct.

Panel of Figure 24 — Figure H.2: Correct, forensically grounded explanations from FOX across the BERTScore distribution on XPV. The rotated label gives the ground-truth class; FOX predicts the correct verdict in all four cases. The two rows per class are drawn from the high and low ends of the BERTScore distribution.

Panel of Figure 25 — Figure H.3: Representative failure modes of FOX on XPV. The rotated label gives the ground-truth class and the predicted class; the verdict is wrong in all four cases. The two rows per direction are drawn from the high and low ends of the BERTScore distribution among wrong verdict predictions.

AI-Generated Image Detection

AI-generated image detection identifies synthetic or AI-edited images and develops methods that generalize across generators, domains, and image transformations.

See all 201 papers

SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data
Aug 13, 2026Yicheng Bao, Xiahui Guo, Xuhong Wang +1Adversarial Training Adversarial Examples
1East China Normal University · 2Shanghai Artificial Intelligence Laboratory
FACT: A Forensic Agent with Compiled Tool-Use Trajectories for AI-Generated Image Detection
Sep 5, 2026Jiaoyang Chen, Bin Hu, Jingyu Hu +3AI-Generated Image Detection Image Forgery Detection
Lingnan University, Hong Kong · Harbin Institute of Technology, Shenzhen · The University of Hong Kong +2
ForensicConcept: Transferable Forensic Concepts for AIGI Detection
Jun 5, 2026Menyanshu Zhou, Ziyin Zhou, Ke Sun +4Explainable Deepfake Detection Concept-Based Explanations
Key Laboratory of Multimedia Trusted Perception and Efficient Computing, Ministry of Education of China, School of Informatics, Xiamen University, Xiamen 361005, P.R.China · Sino-Russian Research Center for Digital Economy

Aug 13, 2026J/K move · Enter open · S save

SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data

Yicheng Bao, Xiahui Guo, Xuhong Wang, Xin Tan

1East China Normal University · 2Shanghai Artificial Intelligence Laboratory

Adversarial Training Adversarial Examples AI-Generated Image Detection Adversarial Attacks on AI-Generated Image Detectors

Open paper AskPDF arXiv

Detecting AI-generated images is only half the task: a deployed detector must also justify its verdict, yet existing detectors inherit three failure modes from their training data: real and fake images collected from different sources invite provenance shortcuts, supervised explanation corpora teach templated rationales, and a static forgery corpus leaves the decision boundary standing still while generators keep moving. We introduce \methodname{}, an adversarial reinforcement learning framework that pits two heterogeneous models against each other. A diffusion image editor learns to edit real photographs into fake counterparts of those same photographs that fool the current detector, while a reasoning MLLM learns to expose them with a verdict grounded in free-form reasoning. Both rewards are shortcut-proof by design: the attacker is credited only when its edit is faithfully executed, and the defender only when its verdict is correct. As the two models alternate, each round's attacker regenerates a harder training pool aimed at the current detector's blind spots, so the detector must generalize rather than memorize any fixed artifact distribution. Although the explanation is never rewarded, its quality rises round over round as a side effect of accuracy-only training. A detector trained within this loop improves monotonically across rounds on each of three external benchmarks.

Abstract

AI-Generated Image Detection

Explore similar work

SPARED: Reasoning-Based AI-Generated Image Detection via Adversarially Edited Data

FACT: A Forensic Agent with Compiled Tool-Use Trajectories for AI-Generated Image Detection

ForensicConcept: Transferable Forensic Concepts for AIGI Detection