• 

  Confusion Matrix

TikTokTechJam2026: Robust AI-Generated Image Detection

Inspiration and Problem

Generative AI can now produce realistic images quickly and at enormous scale. This creates serious risks for social platforms: misinformation can spread faster, impersonation and fraud become easier, and users may lose confidence in the content they see.

The problem becomes even harder under real-world conditions because an image rarely remains in its original form. Social-media uploads, messaging applications, screenshots, edits, and reposts introduce compression, blur, rescaling, noise, colour changes, and cropping. These transformations can remove the fragile artefacts used by many AI-image detectors.

We built a prototype that classifies an image as authentic or AI-generated/AI-tampered while explicitly testing its robustness against these common redistribution effects.

Instead of relying on a single model and a single type of evidence, our system combines complementary visual, semantic, structural, and forensic signals using a weighted ensemble.

What Our Solution Does

For every uploaded image, the system returns:

• An AI-generated probability from 0 to 1
• A final Authentic or AI-Generated verdict based on a calibrated decision threshold
• The probability contributed by each ensemble member
• A comparison of the original, transformed, and restored images through an interactive interface

The system uses two parallel views of the input image.

Four trained classifiers inspect the redistributed image directly so that potentially useful generation artefacts are preserved. A second copy passes through an augmentation-reversal autoencoder before entering a specialised forensic branch.

This design gives the forensic models a cleaner image while preserving the original evidence for the other classifiers.

Technical Approach

1. Realistic Transformation Pipeline

We created a reproducible augmentation and evaluation pipeline that applies individual transformations or ordered transformation chains.

The supported transformations include:

• JPEG compression at qualities 90, 70, 50, and 30
• Gaussian blur with sigma values 0.5, 1.0, and 2.0
• Downscaling to 50% or 25%, followed by upscaling
• Gaussian noise with sigma values 0.02, 0.05, and 0.10
• Brightness, contrast, and saturation adjustment between 0.8 and 1.2
• Centre cropping followed by rescaling to the original dimensions

The transformation order and parameters are saved with each sample.

This allows us to reproduce failures and compare performance on:

• Clean images
• Individual transformations
• Different transformation severities
• Multi-step redistribution chains

2. Complementary Ensemble Members

Our active weighted ensemble contains five top-level signals.

The forensic signal combines two specialised detectors. Therefore, the complete system uses six detector models and one image-restoration model.

Component	Role in the Ensemble	Why It Is Useful
DINOv2-Small	Self-supervised visual foundation model with a fine-tuned binary classification head	Learns strong general-purpose visual representations and can identify structural or texture inconsistencies without depending on text labels during pretraining. This supports generalisation beyond a single image generator.
YOLO26n-CLS	Lightweight image classifier fine-tuned for authentic versus AI-generated content	Provides an efficient and deployment-friendly visual baseline. It is the largest contributor to the weighted ensemble because it performs the core binary classification efficiently. This is the classification model, not the object-detection version of YOLO.
Swin-Tiny	Hierarchical vision transformer using shifted-window attention	Models local textures and longer-range spatial relationships at multiple resolutions. Its hierarchical features complement DINOv2's global representations and YOLO's efficient discriminative features.
OpenAI CLIP ViT-B/32	Fine-tuned prompt-similarity classifier	Compares image embeddings against prompt sets representing authentic and AI-generated or tampered content. Its vision-language pretraining provides a semantic signal that differs from purely visual binary classifiers.
Restored Forensic Fusion	Autoencoder followed by Community-Forensics and OpenSDI/MaskCLIP	Adds specialised evidence for both fully synthetic images and local AI-based edits. It is kept as one top-level signal so that its two forensic sub-models do not dominate the ensemble.

3. Restoration-Aware Forensic Fusion

The forensic branch is designed to address two different forms of synthetic content:

• Fully AI-generated images
• Authentic images containing locally AI-generated or manipulated regions

The forensic branch works as follows:

1. A small convolutional autoencoder is trained using paired augmented input → clean target examples.
2. Its encoder compresses the damaged image into a latent representation.
3. Its decoder reconstructs a cleaner version using transposed convolutions.
4. Community-Forensics analyses the restored image for evidence that the entire image is synthetic.
5. OpenSDI/MaskCLIP analyses the image for local diffusion-based editing or inpainting.
6. The Community-Forensics and OpenSDI probabilities are fused into one forensic score.

The autoencoder uses mean-squared reconstruction error as its training objective.

It is not treated as another detector and does not vote directly in the ensemble. Instead, it is used only before the forensic branch.

Applying restoration to every model could remove subtle AI-generation artefacts. Therefore, DINOv2, YOLO26n-CLS, Swin-Tiny, and CLIP continue to inspect the original redistributed image.

4. Weighted Probability Fusion

Each ensemble member outputs a probability, (p_i), that the image is AI-generated or AI-tampered.

The final probability is calculated using a normalised weighted average:

[ P(\mathrm{AI}) = \frac{\sum_i w_i p_i} {\sum_i w_i} ]

For the active five-signal configuration, the ensemble uses the following weight vector:

Ensemble Signal	Weight	Approximate Contribution
YOLO26n-CLS	0.4167	41.67%
DINOv2-Small	0.1667	16.67%
Swin-Tiny	0.1667	16.67%
CLIP ViT-B/32	0.1667	16.67%
Restored Forensic Fusion	0.0833	8.33%

The small difference from exactly 1.0 is caused by decimal rounding and is removed through normalisation.

The member weights and final decision threshold are selected using validation predictions rather than the locked test set.

The ensemble training utility can optimise:

• Balanced accuracy
• Accuracy
• F1 score
• Youden's J statistic
• ROC-AUC
• Recall under a maximum false-positive-rate constraint

Weighted fusion is more suitable than a simple majority vote because the models have different levels of accuracy, calibration, and specialisation.

It also preserves useful information when several models are moderately suspicious, even if none of them produces a hard positive vote individually.

How the Models Complement One Another

No single detector is reliable under every transformation or against every image generator.

• YOLO26n-CLS provides a strong and efficient binary classification signal.
• DINOv2-Small contributes transferable self-supervised visual features.
• Swin-Tiny analyses hierarchical local-to-global image structure.
• CLIP contributes semantic and vision-language evidence.
• Community-Forensics specialises in detecting fully synthetic images.
• OpenSDI specialises in detecting and localising manipulated image regions.
• The autoencoder attempts to recover information damaged by post-processing before forensic analysis.

Their errors should be less correlated than the errors produced by multiple copies of the same architecture.

When compression weakens fine forensic traces, the semantic and global branches may remain useful. When an image appears semantically normal but contains a locally generated region, OpenSDI can provide evidence that whole-image classifiers may miss.

When restoration recovers useful structure, Community-Forensics receives the restored image. When restoration risks removing generation artefacts, the remaining models continue to analyse the original image.

Evaluation Strategy

We evaluate robustness as a first-class requirement instead of reporting only one clean-data accuracy value.

1. Leakage-Safe Splitting

Source images are divided into training, validation, and test groups before augmented variants are created.

A clean image and all its transformed variants remain in the same split. This prevents information from the same source image from appearing in both training and testing.

2. Clean Benchmark

Every individual model and the complete weighted ensemble are evaluated using untouched test images.

3. Single-Transformation Benchmark

The same locked test set is evaluated separately under:

• JPEG compression
• Gaussian blur
• Resizing
• Gaussian noise
• Colour adjustment
• Cropping

Each transformation is tested at multiple severity levels.

4. Transformation-Chain Benchmark

Images are evaluated after randomly ordered combinations of several transformations.

This simulates repeated editing, uploading, downloading, and reposting.

5. Generalisation Benchmark

Where source metadata permits, image-generator families are held out during training.

Additional external datasets can also be used to evaluate cross-dataset generalisation.

6. Ablation Study

We compare:

• Every individual model
• The forensic fusion branch
• An unweighted ensemble
• The weighted ensemble
• The forensic branch without autoencoder restoration
• The forensic branch with autoencoder restoration

For every evaluation condition, we report:

• Accuracy
• Balanced accuracy
• Precision
• Recall
• F1 score
• ROC-AUC
• False-positive rate
• Confusion matrix

We also report robustness retention, which measures the difference between clean and transformed performance.

A model with slightly lower clean accuracy may still be more useful if its performance degrades less after realistic redistribution.

False positives are analysed separately because incorrectly labelling an authentic image as AI-generated can damage user trust.

Ensemble weights and the operating threshold are selected using validation data only. The final test set remains locked until the architecture, weights, and threshold have been fixed.

This separation prevents test-set tuning and provides a more honest estimate of deployment performance.

Development Tools

• Visual Studio Code for local development, package integration, debugging, and Streamlit application development
• Google Colab for GPU-based model training
• Jupyter Notebook for experimentation, checkpointing, visualisation, and evaluation
• Git and GitHub for version control and team collaboration
• uv for Python dependency resolution and reproducible monorepo environments
• Amazon S3 for storing and streaming large image datasets and metadata records without requiring the complete dataset on every training machine

Models and External Assets

The project uses the following pretrained models and assets:

• Facebook/Meta DINOv2-Small pretrained backbone with our binary classification head
• Ultralytics YOLO26n classification checkpoint fine-tuned for our binary task
• Microsoft Swin-Tiny architecture and pretrained weights, fine-tuned for binary classification
• OpenAI CLIP ViT-B/32, fine-tuned using visual transformer layers and prompt-similarity classification
• Community-Forensics ViT checkpoint for whole-image synthetic detection
• OpenSDI/MaskCLIP and MAE pretrained weights for image-manipulation localisation
• Our trained convolutional augmentation-reversal autoencoder

The prototype performs inference locally using model checkpoints. It does not depend on a paid image-detection API.

Libraries and Frameworks

The project is built in Python using:

• PyTorch and torchvision for training, tensor operations, model inference, and image preprocessing
• Hugging Face Transformers, Datasets, and Hub tooling for DINOv2, Community-Forensics, and streaming SID-Set data
• Ultralytics for YOLO26n-CLS training and inference
• OpenAI CLIP and timm for CLIP and transformer model support
• scikit-learn for ensemble weight evaluation, threshold selection, and optional meta-classifier experiments
• Streamlit for the interactive upload, transformation, restoration, and detection interface
• Pillow and NumPy for deterministic image transformations and preprocessing
• pandas and Matplotlib for result tables, probability charts, learning curves, and confusion matrices
• boto3 and tqdm for Amazon S3 data access and progress monitoring

Datasets and Generated Assets

Our primary dataset is SID-Set (saberzl/SID_Set) from Hugging Face.

It provides three labels:

• Real
• Synthetic
• Tampered

For this safety-oriented binary classification task:

• Real images are mapped to class 0.
• Synthetic and tampered images are mapped to class 1.

The data pipeline can stream balanced samples directly instead of loading the complete dataset into memory.

From each selected source image, we generate clean and transformed variants together with JSON metadata describing:

• The source label
• The transformation order
• The transformation parameters
• The input path
• The target path
• The storage location

For autoencoder training, each transformed input is paired with its clean target.

When cropping is applied, the target receives the same crop. This prevents the autoencoder from being asked to recreate image content that was completely removed.

These assets can be stored locally or streamed to Amazon S3 using a resumable format.

The repository also contains:

• A small labelled sample dataset for demonstrating the web interface
• Trained model checkpoints
• Training histories
• Validation predictions
• Confusion matrices
• Other evaluation artefacts

Trade-Offs and Limitations

The ensemble improves detection coverage but increases inference time and memory usage compared with a single lightweight model.

OpenSDI is particularly computationally demanding because it operates at a higher resolution and produces a spatial manipulation map.

A production system could first run the lightweight models and invoke the forensic branch only for uncertain or high-risk cases.

Restoration also creates a trade-off.

It can recover image structure damaged by compression or noise, but excessive smoothing may remove evidence of AI generation. This is why only the forensic branch receives the restored image.

Weighted averaging improves stability, but the output probabilities may still require recalibration when the platform, user population, or image-generator distribution changes.

No detector can guarantee perfect performance against:

• Unseen image generators
• New editing techniques
• Adversarial attacks
• Heavy image degradation

Our prototype therefore exposes individual model scores and, where available, a localisation map instead of presenting the final verdict as unquestionable ground truth.

Future improvements include:

• Broader cross-generator testing
• Probability calibration
• Adversarial robustness testing
• Model distillation
• Conditional model routing
• Inference-latency optimisation

Why This Addresses the Challenge

The central contribution is not simply the use of multiple models.

It is the assignment of different responsibilities to models that observe different forms of evidence, the use of a realistic redistribution pipeline during training and evaluation, and the transparent combination of calibrated probabilities through a weighted ensemble.

This gives the prototype a practical path towards maintaining useful detection performance after the compression, cropping, blur, colour adjustment, noise, and resizing that online images commonly experience.

Robustness Evaluation Summary

The weighted ensemble was evaluated on both clean images and transformed images containing realistic post-processing effects such as compression, blur, resizing, noise, colour adjustment, and cropping.

Metric	Clean Images	Transformed Images	Change
Accuracy	0.8500	0.8500	0.0000
Precision	0.7800	0.7917	+0.0117
Recall	0.9750	0.9500	-0.0250
F1 score	0.8667	0.8636	-0.0031
ROC-AUC	0.9819	0.9731	-0.0088
False-positive rate	0.2750	0.2500	-0.0250

The ensemble maintained the same 85.00% accuracy after image transformation. Its F1 score decreased by only 0.31 percentage points, while ROC-AUC remained above 0.97, showing that the model retained strong separation between authentic and AI-generated images.

Precision increased from 78.00% to 79.17%, and the false-positive rate improved from 27.50% to 25.00%. Recall decreased slightly from 97.50% to 95.00%, suggesting that transformations removed some of the visual or forensic evidence from a small number of AI-generated images.

Overall, the small changes between clean and transformed performance show that the ensemble is robust against the post-processing operations commonly introduced through editing, compression, and redistribution.

Error Analysis Note

False Positives

The main limitation of the current system is its false-positive rate. On clean images, 27.50% of authentic images were incorrectly classified as AI-generated. This decreased slightly to 25.00% after transformation.

Representative false-positive cases to examine include:

• Authentic photographs with unusually smooth textures
• Images containing strong noise reduction or beauty filters
• Heavily compressed or repeatedly reposted photographs
• Studio photographs with artificial lighting and uniform backgrounds
• Digital artwork, computer-generated graphics, or highly stylised photographs
• Images with shallow depth of field or large blurred regions

These images may contain visual patterns that resemble generative-AI artefacts. The high false-positive rate is also linked to the system's decision threshold, which prioritises detecting as many AI-generated images as possible.

False Negatives

False negatives were less common. The model missed approximately 2.50% of AI-generated images on clean data and 5.00% on transformed data.

Representative false-negative cases to examine include:

• Highly photorealistic AI-generated images
• Images generated by models not represented in the training dataset
• AI-generated images with realistic lighting, anatomy, and textures
• Images where cropping removes suspicious regions
• Images where blur, compression, or resizing weakens generation artefacts
• Locally manipulated images where the edited region occupies only a small part of the image

The increase in the false-negative rate after transformation suggests that post-processing can weaken the texture, frequency, or forensic signals used by the ensemble.

Detection Trade-Off

The current operating point favours high recall. This is useful for platform safety because it reduces the likelihood that AI-generated content passes through undetected. However, it also causes more authentic images to be incorrectly flagged.

Raising the final decision threshold would likely reduce false positives and increase precision, but it could also increase false negatives and reduce recall. The appropriate threshold therefore depends on the intended application:

• A moderation or fraud-screening system may prioritise high recall.
• A public authenticity label should use a stricter threshold to avoid falsely accusing authentic creators.
• Uncertain cases could be sent for additional forensic analysis or human review instead of receiving an automatic verdict.

Future improvements should focus on probability calibration, threshold optimisation, additional authentic-image training data, and targeted analysis of the false-positive cases. The ensemble could also use an uncertainty region in which low-confidence predictions are marked as inconclusive rather than being forced into an authentic or AI-generated category.

Built With

• boto3
• clipvit-b/32
• community-forensics
• dinov2-small
• matplotlib
• numpy
• opensdi
• pandas
• pillow
• python
• pytorch
• sid-set
• streamlit
• swin-tiny
• tensorflow
• tqdm
• ultralytics
• yolo26n-cls