DUET | Devpost

Our pipeline
Robustness of each layers' robustness in Dinov3 (We didn't use it as backbone because uncertain of permission)
Robustness of each layers' robustness in Dinov2 (Model-agnostic)

💡 Inspiration (Don't miss our video!)

AI-generated image detectors are often evaluated on clean images. That is not what images look like after being posted online.

Social media images may be resized, cropped, blurred, recompressed, colour-adjusted, or screenshotted. These operations can remove the visual artifacts that a detector depends on. At the same time, running a very large vision model to its final layer for every image is expensive.

We started DUET with two questions:

Can features from several transformer depths produce a more reliable prediction than the final layer alone?
Can clean images terminate early while degraded images receive additional processing?

🎯 What it does

DUET — Depth-Uniform Ensemble with early Termination detects whether an image is real or AI-generated.

It uses two groups of intermediate DINOv2 features:

a shallow expert group for clean-leaning images;
a deep expert group for degraded or harder images.

Every image is first processed up to transformer block 27. A binary gate then predicts whether any degradation has been applied.

If the image is classified as clean, DUET returns the shallow ensemble score and terminates at L27. If it is classified as degraded, the backbone continues to L37 and returns the deep ensemble score.

The output includes the final AI-generation score, prediction route, individual expert scores, and the amount of backbone computation used.

🔧 How we built it

We deliberately perform this fusion in logit space and do not train an additional fusion model.

The gate only reads shallow features. It is trained with binary cross-entropy to predict whether an image has undergone any degradation. This makes it possible to decide at L27 whether the remaining backbone computation is needed.

Although the frozen backbone contains around 1.1 billion parameters, DUET only trains six MLP heads and one gate, totalling approximately 7 million trainable parameters.

We started with 🤗 140,438 source images and created paired clean and degraded examples, resulting in 280,876 training rows. For each degraded image, we sampled between one and two operations from six degradation types, including geometric and photometric transformations, blur, noise, resizing, cropping, and JPEG compression. The operations follow a fixed order, with blur applied before noise and JPEG compression applied last.

All train and validation splits are grouped by source image. This prevents a clean image from appearing in one split while its degraded counterpart appears in another. We also kept a separate hard validation set of 2,500 images that was withheld from the layer-selection process.

We did not manually choose L14, L21, L27, L26, L33, and L37. We fitted a linear probe to every transformer block and measured its ROC-AUC across different evaluation buckets. We then scored candidate layer triples using rank-averaged AUC and used a permutation test to check whether the selected triples performed better than randomly constructed alternatives.

Model training was performed on a single NVIDIA RTX PRO 4000 for approximately 6 hours.

🧗 Challenges we ran into

The hardest part was making the experiments trustworthy.

Layer selection can easily overfit a validation set. Clean and degraded copies can also leak across data splits if grouping is not enforced. We therefore kept the official validation split frozen, constructed source-grouped splits, and maintained a separate hard set.

Another challenge was degradation mismatch. The official evaluation pipeline contains transformations that are not fully represented by our six training operators. The gate can also associate blur or low resolution with degradation even when those properties occur naturally.

Our initial routing design was more complicated. We wanted the system to choose a different optimal depth for every degradation type, but the measured improvement was not reliable. In our cleanest comparison, fine-grained routing improved ROC-AUC by only 0.117 percentage points, and the result was not statistically significant. We eventually replaced this idea with a simpler binary clean/degraded gate.

Finally, caching features from a 1.1-billion-parameter backbone required substantial storage and data-transfer work, even though the trainable heads themselves were small.

📊 Accomplishments that we're proud of

The most consistent result came from combining multiple depths with simple uniform averaging.

Compared with the best individual expert, uniform fusion improved ROC-AUC by:

+3.39 points for the shallow group on official validation;
+1.67 points for the deep group on official validation;
+5.89 points for the shallow group on the hard split;
+1.74 points for the deep group on the hard split.

The experts were not making identical errors. Averaging their logits reduced prediction variance, particularly when the selected layers were spread across different depths.

We also implemented real staged execution rather than simulating early termination after a complete forward pass. We verified that staged inference was numerically identical to full-forward inference for all six tapped features, with a maximum absolute difference of zero in our test.

For an individual early-exit sample, DUET reduces measured computation by approximately 27.0%. Since not every validation image exits early, the realised average saving across the validation set is 16.4%.

We are especially proud that the final system has only around 7 million trainable parameters while reusing the representation of a frozen 1.1-billion-parameter backbone.

📚 What we learned

The final transformer block is not always the most useful representation for image forensics. Features from different depths capture different evidence, and their errors can be complementary.

We also learned that a simple equal-weight ensemble can be more reliable than a complicated learned routing strategy. Our original fine-grained routing hypothesis was not supported by the experiments, but testing it helped us arrive at a smaller and more defensible system.

Most importantly, evaluation design matters as much as model design. Source-grouped splits, frozen validation sets, permutation tests, and checks for numerical equivalence prevented us from making claims that the evidence did not support.

🎯 Error Analysis Note

False positives — processed real photographs. Phone denoising and multi-frame fusion scrub the noise floor and reconstruct high frequencies, leaving statistics that look generative. This is pathological rather than fixable: modern ISPs already hallucinate detail (night mode, digital zoom), so camera output can genuinely contain synthesised content. False negatives — frontier generators. Expect much worse on FLUX, SD 3.5 or GPT-Image2: our backbone's features predate them, and our training mix contains no closed-API samples.

🚀 What's next for DUET

Our next ablation will add an L40 final-layer baseline using the same frozen-feature protocol. This will provide a direct comparison between conventional final-layer classification and DUET's multi-depth ensemble.

We also plan to: