Project Story

Inspiration

AI-generated images are rarely encountered in their original form. Social platforms and messaging services routinely resize, compress, crop, blur, or otherwise modify them, potentially removing the evidence used by conventional detectors. We built RobustFake to detect AI-generated images while preserving useful ranking performance after these realistic transformations.

Our solution

RobustFake is an image-level AIGC detector built around a frozen OpenCLIP ViT-B-16-quickgelu/openai visual encoder. For each image, it analyses shared-geometry global and local views and extracts both the final CLIP embedding and intermediate representations from transformer blocks 4, 7, 10, and 12.

A trainable layer gate combines these representations, while view-wise mean and standard deviation capture agreement between global context and local detail. A supporting residual branch measures directional, Laplacian, and adjacent-pixel statistics. The resulting features are processed by a compact binary classification head with fewer than five million trainable parameters.

During training, clean and transformed versions share identical crop geometry. The objective combines binary cross-entropy, probability-space consistency, and supervised contrastive learning:

[

\mathcal{L}

\frac{\mathrm{BCE}{clean}+\mathrm{BCE}{transformed}}{2} +0.5\,r(t)\,\mathrm{SmoothL1}(p_t,\operatorname{stopgrad}(p_c)) +0.05\,\mathcal{L}_{SupCon}. ]

A checkpoint-bound affine Platt calibrator converts the detector’s raw logit into an interpretable AIGC risk score.

Data and evaluation

We prepared a balanced pool of 80,000 images from four complementary public sources: Shanmuk, WildFake, Community Forensics-Small, and Tiny-GenImage. The split contains 64,000 training images, 8,000 in-distribution validation images, and 8,000 domain-generalisation validation images with held-out domains, generator architectures, and community model identities.

Encoded-file hashes, decoded-pixel hashes, perceptual hashes, and crop-resistant hashes audit duplicate leakage. The official WildFake demonstration subset is excluded from checkpoint selection, calibration, and threshold fitting.

On all 13,841 official demonstration images, RobustFake achieves:

0.9792 clean AUROC
0.9683 mean AUROC across 14 prescribed transformations
0.9432 worst prescribed-transform AUROC
0.8968 mean AUROC across additional composed stress tests

Technical implementation

The project was developed in Visual Studio Code using a Python command-line workflow. Its main technologies include:

Python and PyTorch
OpenCLIP and torchvision
Hugging Face Hub and ModelScope
scikit-learn, NumPy, Pillow, and PyArrow
CUDA mixed-precision execution
Deterministic FP16 feature caching
Platt calibration
SHA-256 and perceptual-hash leakage auditing
uv for dependency management and reproducible commands

The released CLI recursively processes an image directory and atomically writes the required JSON output:

{"image_path": "path/to/image.jpg", "pred": 0.9231}

Challenges and lessons learned

The main challenges were preventing dataset leakage, representing diverse real-image and generator domains, maintaining performance after severe transformations, and running repeated experiments under limited compute. Freezing CLIP and caching its features allowed us to iterate on the trainable head without repeatedly executing the backbone.

Our ablations showed that multi-layer fusion provides the largest measured robustness contribution, while residual statistics supply complementary forensic evidence. We also learned that strong AUROC does not guarantee a uniformly safe threshold: severe composed transformations can still create false positives and false negatives. RobustFake should therefore be used as a calibrated review signal with human escalation—not as definitive proof of authenticity.