-
-
Poster
-
Framework of RobustFusion
-
Model details
-
Results
-
Example
-
Confidence analysis-1
-
Confidence analysis-2
Inspiration
AI-generated images rarely remain pristine after publication. Social platforms resize them, recompress them, crop them, adjust their colors, and sometimes introduce noise. A detector that works only on clean benchmark images may fail after these everyday transformations.
We built RobustFusion around one practical question:
Can an AI-image detector remain reliable after an image passes through real-world editing and sharing pipelines?
Our goal was not to maximize performance on a single generator. We wanted to combine complementary evidence and remain stable across generators, domains, and post-processing conditions.
What it does
RobustFusion classifies an image as real or AI-generated by fusing four signals:
| Signal | What it captures |
|---|---|
| 🌐 Global forensic evidence | Image-wide structure and consistency |
| 🧩 Local tile evidence | Informative details from multiple image regions |
| 🧠 Semantic evidence | High-level visual and conceptual consistency |
| 〰️ High-frequency stability | Feature response to controlled frequency perturbation |
Conceptually, the detector computes:
$$ z = h\left([f_{\mathrm{global}};\,f_{\mathrm{local}};\,f_{\mathrm{semantic}};\,r_{\mathrm{HF}}]\right), $$
where (h) is the fusion classifier and (z) is the final real-versus-generated logit. The deployed inference graph uses only the four evidence branches and the fusion classifier; the additional robustness objectives are training-only.
How we built it
We use a frozen DINOv2 encoder with parameter-efficient LoRA adaptation to extract global and local forensic representations. Four image tiles are processed and combined through learned attention pooling, allowing the detector to focus on informative regions without depending on one fixed crop.
A frozen SigLIP image encoder contributes semantic evidence. A Haar-based branch measures high-frequency feature stability. The four signals are concatenated and passed through the RobustFusion prediction head.
During training, every image can produce clean and degraded views. The optimization combines:
- ✅ Binary real-versus-generated classification
- 🔄 Clean/degraded feature consistency
- 🧪 Degradation-type and severity prediction
- 🧩 Tile-level supervision
- ⚖️ Class-and-source GroupDRO
- 🎯 Hard-example and class-gap penalties
- 🎛️ Dynamic auxiliary-loss balancing
Training, validation, calibration, and external testing were kept separate. Platt calibration parameters and the decision threshold were frozen before external evaluation.
Results
🖼️ 5,912 images · 🧪 7 datasets · 🔄 16 conditions · 🔎 94,592 audited predictions
| Metric | Clean | Mean over 15 transformations | Worst condition |
|---|---|---|---|
| Macro AUROC on six paired datasets | 93.19% | 89.91% | 83.54% |
| Macro accuracy across seven datasets | 83.82% | 79.21% | 71.41% |
Clean AUROC 93.19% ███████████████████░
Transformed AUROC 89.91% ██████████████████░░
Worst condition 83.54% █████████████████░░░
The average clean-to-transformed AUROC decrease was only 3.28 percentage points. MidJourney was especially stable, retaining 93.84% worst-condition AUROC.
Strong Gaussian noise at (\sigma=0.10) was the most difficult transformation. FLUX and Frontier were also harder than DALL-E 3 and MidJourney, showing that robustness is not uniform across generators.
Challenges we faced
🧱 Avoiding fragile shortcuts
A detector can achieve strong clean accuracy by learning generator-specific textures or compression artifacts. Those shortcuts may disappear after resizing and recompression. RobustFusion addresses this by combining global, local, semantic, and frequency evidence rather than relying on one feature family.
⚖️ Balancing false positives and false negatives
The calibrated operating point prioritizes generated-image recall. Across the six paired clean datasets, fake recall was approximately 94.85%, while real-image recall was approximately 79.53%. Catching more generated images therefore comes with a meaningful real-image false-alarm cost.
🧪 Evaluating robustness fairly
Model comparisons become difficult when preprocessing and calibration protocols differ. We defined a fixed RGB → (256\times256) bicubic → JPEG-Q95 evaluation pipeline and recorded the protocol with every result.
💻 Reproducibility across hardware
We reproduced the evaluation on NVIDIA H100/CUDA and Apple M5 Pro/MPS. Large datasets produced nearly identical results, while smaller datasets were more sensitive to minor BF16 ranking differences.
What we learned
- 📊 Clean accuracy is not enough. Mean performance, worst-case robustness, AUROC, and thresholded errors describe different model properties.
- 🎚️ Ranking and deployment decisions are different. Strong AUROC does not guarantee that one global threshold will produce an acceptable false-positive rate in every domain.
- 🌪️ Transformations are not equally difficult. Mild resizing had almost no effect, while strong Gaussian noise produced the largest decline.
- 🔒 Data separation matters. Calibration and threshold selection must happen before external testing.
- 🌍 Generator shift remains a central challenge. Performance must be evaluated across both familiar and frontier generation systems.
What's next
- 🎚️ Add calibration-derived high-sensitivity and low-false-alarm operating points
- 🌪️ Improve robustness to strong Gaussian noise
- 🌍 Expand training and testing to additional frontier generators
- 🔍 Review the highest-confidence false positives and false negatives visually
- 🧪 Rerun public baselines on identical aligned manifests
- 📐 Add paired confidence intervals and statistical significance tests
RobustFusion shows that combining complementary evidence can substantially improve stability under real-world transformations, while also exposing the remaining challenges of threshold calibration, generator shift, and severe corruption.
Log in or sign up for Devpost to join the conversation.