MIRROR-Guard: Zero-Shot Manifold-Reference AI Image Detection in Real-World Scenarios

Links

GitHub repository: https://github.com/deccassie4-prog/robust-aigc-detector
Demo video (YouTube, public): https://youtu.be/9bcmF4S9U0U

One-line pitch

SURVIVE THE REAL WORLD: robust, zero-shot detection of AI-generated images under severe JPEG compression, blur, scaling, noise, color jitter, and cropping — powered by a 0.856B-parameter manifold-reference model, zero fine-tuning, and a process-isolated batch GUI.

Inspiration: The Problem with the "Real World"

Generative AI models make photorealistic synthetic images trivial to create. But in real-world platform scenarios, the challenge is not detecting pristine, freshly generated fakes. Images are repeatedly re-encoded, compressed, cropped, blurred, and de-noised as they travel through social networks and messaging apps.

Traditional AIGC detectors try to memorize generator-specific high-frequency artifacts (checkerboard patterns, spectral spikes). In practice, these brittle signatures vanish after a single round of aggressive JPEG re-compression or Gaussian smoothing.

We started from a different question: what signal survives the real-world upload pipeline?

Instead of chasing fleeting fake artifacts, our detector explicitly models the statistical manifold of real natural images. Synthetic images, however photorealistic, contain structural and physical inconsistencies that the natural-image manifold cannot explain. Measuring the comparison residual between an input and its "ideal natural reference" yields robustness that requires no re-training.

What It Does

An end-to-end, competition-compliant detection suite engineered for consumer hardware:

predict.py (core deliverable) — recursively scans any image directory and writes the exact required JSON schema: one {"image_path", "pred"} entry per image, pred = probability of being AI-generated. Failed reads are reported as pred = -1, never silently dropped.
Multi-crop ensembling (3×3–5×5 grids) — catches localized artifacts hidden outside the center view. In our diagnostics, multi-crop ensembling with mean aggregation raised detection confidence on a heavily cropped AI image from P(fake) = 0.23 (missed) to P(fake) = 0.80 (caught), with zero false positives on real camera photos.
Process-isolated batch GUI (predict_gui.py) — a dependency-free Tkinter application for large evaluation campaigns. Each tab is an isolated sub-batch in its own Python process: memory isolation and fault tolerance against GPU driver resets, with per-batch summaries.
Full robustness pipeline — all six competition transformation families (JPEG compression, Gaussian blur, rescaling, Gaussian noise, color jitter, center crop) generated and evaluated at scale; per-image scores for every condition are committed to the repository.

How We Built It

Manifold-reference architecture

We adopted the MIRROR paradigm (arXiv:2602.02222), a two-stage reference-comparison pipeline:

Feature extraction — a frozen DINOv3-Huge backbone extracts semantic and structural features.
Natural memory bank — an orthogonal memory bank (K = 4096 prototypes, sparse top-k attention) represents natural-image physics.
Residual scoring — the input is projected onto the memory bank to reconstruct an "ideal reference". The comparison residual — the part of the image natural physics cannot reconstruct — drives the classification probability.

Parameter compliance audit

Component	Parameters
Backbone (DINOv3-Huge + LoRA)	842.6M
Memory bank	11.8M
Detection head	1.6M
Total (measured)	855,964,616 ≈ 0.856B

Strictly within the competition's <2B limit. The count is reproducible with our committed scripts/param_viewer.py, which counts any checkpoint's tensors from metadata alone (no model instantiation). Note the three weight files overlap — the Phase-2 checkpoint contains the backbone and the memory bank — so the deployed model counts once, 0.856B.

Key engineering contributions

Silent LoRA weight-drop fix. We audited Hugging Face transformers 5.x loading behavior and found that strict=False silently dropped 192 LoRA key weights (the library moved the DINOv3 layer list from dino.layer to dino.model.layer). We implemented a key-remapping layer and verified complete numerical parity with a byte-level equivalence gate.
Crop-block memory management. Grid multi-crop initially triggered OOM because batch_size was interpreted as whole images, amplifying forward passes 9–25×. We redefined batching semantics to crop-blocks (~130 MB per block, default 32 blocks/batch), capping VRAM at ~10 GB on consumer hardware (verified on RTX 3080).
512px scale-normalization protocol. Without scale normalization, 224px center cropping acts as an extreme zoom on high-resolution originals (4000px+), spiking real-image false-positive rates to 41–85%. The 512px short-side normalization removed this bias and is a load-bearing part of the pipeline.
Zero-shot discipline. No training or fine-tuning was performed anywhere in the project. Pretrained MIRROR weights were used directly; the competition validation subset (COCO val2017 + DALL·E Advanced) was used strictly for evaluation.

Results & Robustness Summary

All numbers below are computed from the per-image prediction JSONs committed in the repository (evaluation/results/), decision threshold 0.5.

Competition validation set — balanced accuracy 99.37%: real images (COCO val2017, 5,000) are classified with 100.00% accuracy; AI-generated images (DALL·E Advanced, 8,843) with 98.74%.

Robustness study (SID_Set, 38,897 fake / 30,983 real images per condition):

Transformation	Fake detection (TPR)	Real false positives (FPR)	Balanced accuracy
Clean (no transform)	99.99%	2.41%	98.79%
JPEG compression	99.17%	0.41%	99.38%
Gaussian blur	99.98%	3.05%	98.47%
Rescaling	99.56%	0.71%	99.43%
Gaussian noise	98.57%	0.10%	99.24%
Color jitter	99.99%	0.44%	99.78%
Center crop	99.99%	1.06%	99.47%

Detection of AI-generated images stays above 98.5% under every transformation, with real-image false positives at or below 3.05% — clean-set performance is essentially preserved under all six real-world transformations.

Key finding on the decision boundary. Across all 503,003 scored images in our committed evaluation runs, there are 3,712 misclassifications (0.74%) — and 87.0% of them (3,230) are boundary-adjacent (0.25 < pred < 0.75), while only 13.0% (482) are confident inversions (pred ≤ 0.25 or ≥ 0.75). The manifold residual therefore degrades gracefully: failures cluster tightly around the decision threshold instead of collapsing randomly.

Error Analysis & Trade-Offs

Representative failure modes

False positives (real images predicted as AI-generated, pred > 0.90) concentrate in heavily edited, commercial, studio-isolated photography:

A commercial food product shot (pred = 0.955): ultra-clean studio lighting, boosted saturation, and perfectly uniform arrangement mimic diffusion-style texture rendering.
An e-commerce apparel photo (pred = 0.947): airbrushed skin tones and a completely featureless monochrome background.
An isolated home-appliance product render (pred = 0.909): metallic reflections and pure-white studio isolation remove all environmental context.

False negatives (AI images predicted as real, pred < 0.25) concentrate in non-photorealistic media:

A colored-pencil hand drawing (pred = 0.113): natural paper texture and physical strokes dominate over synthetic geometry.
A pixel-art scene in a simulated CRT frame (pred = 0.151): non-photorealistic styles lack natural lighting anomalies.
A crayon family illustration (pred = 0.218): hand-drawn line art sits outside the photorealistic synthetic distribution.

Transformation asymmetries

Gaussian blur produces the highest real-image false-positive rate (3.05%) — smoothing removes the fine natural textures the manifold relies on.
Gaussian noise is the hardest transformation for fake detection (TPR 98.57%) — noise masks subtle generation artifacts.
Color jitter is effectively free (99.78% balanced accuracy) — the residual signal is largely color-invariant.

Challenges We Ran Into

Silent compatibility failures in model dependencies. Upgrading to Hugging Face transformers 5.x silently changed LoRA weight key binding rules — 192 critical parameters were skipped without any error. We resolved it with the key-remapping layer plus an automated byte-level numerical-parity gate that re-runs a fixed benchmark after every dependency change.
Hardware stability & driver anomalies. During prolonged grid runs we hit sporadic CUDA device-side asserts. Running with CUDA_LAUNCH_BLOCKING=1 and correlating Windows Event Logs (nvlddmkm) pointed to GPU TDR driver resets under heavy VRAM pressure. This directly motivated the process-isolated GUI architecture: every evaluation sub-batch runs in a fresh subprocess, so a driver reset costs one batch, never the whole campaign.

What We Learned & What's Next

Aggregation sensitivity. max aggregation over multi-crop grids boosts recall for off-center artifacts but raises sensitivity to studio-lighting false positives; mean over a 3×3 grid is our default operating point.
Future work:
1. Extend the natural memory bank to cover non-photorealistic artistic styles (line art, pixel art, flat vector), eliminating the dominant false-negative family.
2. Adaptive thresholding based on estimated compression level and spatial-frequency density, targeting the boundary-adjacent error band.
3. Multi-level sweeps of each transformation family (e.g., JPEG quality 90/70/50/30) for finer robustness curves.

Built With

python, pytorch, huggingface-transformers, peft, torchvision, numpy, pandas, scikit-learn, pillow, tkinter, cuda
Development tools: vscode, git

Compliance & Data Isolation Statement

Model size: 0.856B parameters (855,964,616 measured), strictly within the <2B rule; reproducible with the committed param_viewer.py tool.
Zero-shot paradigm: pretrained MIRROR weights were used directly. The competition validation subset (COCO val2017 & WildFake DALL·E Advanced) was used exclusively for evaluation — never for training or fine-tuning.

Team & Credits

Zhang Yiran — inference pipeline & model execution
Liu Zhenning — robustness evaluation
Chen Yizhen — repository & reproducibility
Zhou Shuyuan — error analysis & interpretability
Wang Zihan — Devpost & presentation

Acknowledgements: upstream MIRROR architecture (handsome-rich/MIRROR, MIT License, arXiv:2602.02222), Meta DINOv3 backbone, COCO Consortium, and the WildFake dataset maintainers.

Built With

Submitted to

TikTok TechJam 2026

Created by

Zhang Yiran — inference pipeline & model execution
Set up the required environment and downloaded the required model weights.
Organised the validation dataset into the required real and AI-generated image structure.
Ran the original inference pipeline and established the clean-image baseline performance.
Verified the total number of model parameters against the competition limit of fewer than 2 billion parameters, and built scripts/param_viewer.py to make the check reproducible for any checkpoint.
Developed predict.py, which takes an image directory as input and outputs a JSON file containing image_path and pred for each image, plus predict_gui.py as its batch-oriented frontend.
Documented the environment setup and implementation issues for the rest of the team.

Murasame Sama
I conducted a comprehensive error analysis and robustness evaluation for our zero-shot AI-generated image detector (MIRROR model). I systematically benchmarked the model under various image transformations, identified key failure modes (False Positives and False Negatives), analyzed internal visual residual representations, and proposed actionable next steps for model optimization.

shuyuan zhou
LIU Zhenning :In my robustness evaluation, I applied six types of image processing—scaling, cropping, Gaussian blur, color jitter, noise, and JPEG compression—to generate perturbed variants of the original images. These processed images were then fed into an AI detection model, and I quantified the resulting detection outputs into a structured table. This tabular summary enables systematic comparison of the detector's performance under each distortion, clearly highlighting which transformations cause the most significant performance drops. The chosen perturbations simulate common real-world degradations and potential adversarial effects. My work provides a clear, quantitative benchmark for assessing model resilience and offers actionable insights for improving detection reliability in practical scenarios.

Zhenning LIU
Chen Yizhen — Repository & Project Management
Set up and maintained the GitHub repository and project directory structure. Created the README.md and CONTRIBUTING.md to document the project, team responsibilities, and collaboration workflow. Established a Git workflow using branches, commits, pull requests, and merges. Added and maintained essential files including LICENSE, requirements.txt, and .gitignore. Organized and integrated team deliverables to ensure a clear and reproducible project structure.

yizhen Chen
As the Deliverables Lead, I spearheaded the overall team orchestration, technical storytelling, and final submission for the "MIRROR-Guard" AI image detection hackathon project. I directed cross-functional collaboration across four specialized sub-teams (Inference Engine, Robustness Benchmarking, Infrastructure, and Error Interpretability), authored the complete 1,800+ word Devpost technical report, and structured the core narrative around the zero-shot reference-comparison paradigm, 512px scale normalization, and boundary-adjacent error dynamics. I enforced strict compliance audits verifying the model's 0.856B parameter count against the <2B limit with 57.2% headroom, while guaranteeing zero validation data leakage into training. Furthermore, I designed the 3-minute pitch video storyboard and timed English voiceover script, coordinating key visual assets of the custom Tkinter batch GUI and Model Parameter Viewer to deliver a highly persuasive presentation across all competition judging criteria.

Wang Zihan