RobustLens

RobustLens estimates whether an image is AI-generated after layers of post-processing using calibrated multi-view scoring, transformation-chain testing, and safe abstention when evidence degrades.

Comment

Inspiration

We started with something personal: a friend of ours was deepfaked, and the image was circulated without consent.

Seeing how quickly a fabricated image could turn into a real violation of someone’s privacy, modesty, and dignity made the problem feel much closer than a typical machine-learning benchmark.

When our team came together, we wanted to build something that could assist potential victims, moderators, and communities before manipulated images spread further. We did not want to create a tool that made accusations with false certainty. We wanted to ask a more responsible question:

How much evidence survives after an image has been edited, compressed, resized, cropped, screenshotted, and shared again? That question became our idea; RobustLens.

What it does

RobustLens estimates the likelihood that an image is AI-generated. It scores the original image and then evaluates it after realistic transformations such as: 1) JPEG compression; 2) Gaussian blur; 3) resizing and upscaling; 4) Gaussian noise; 5) colour adjustments; and 6) centre cropping. The clean and transformed predictions are combined into a final calibrated score:

$$ p_{\mathrm{final}} = 0.7p_{\mathrm{clean}} + 0.3\left(\frac{1}{14}\sum_{i=1}^{14}p_i\right) $$

The system also measures prediction consistency across transformed versions. If the score changes significantly, the result becomes less trustworthy.

For compound transformation chains, RobustLens can abstain and return Uncertain instead of forcing a potentially misleading classification. Abstention only withdraws a claim; it never reverses the predicted class.

Optional patch analysis provides a heatmap showing which regions influenced the model’s score. It is explainability only, not proof of AI editing or a segmentation mask.

How we built it

We built RobustLens around the Bombek1 SigLIP2 + DINOv2 LoRA checkpoint, with 740,371,777 parameters—well below the competition’s 2-billion-parameter limit.

The two visual backbones feed one shared classification head and produce a single image-level AI-generation score. The pipeline validates the input, preprocesses the image, generates deterministic transformation variants, scores each view, calculates consistency, applies calibration and the frozen threshold, evaluates abstention rules, and returns structured output.

The project includes a Streamlit interface, command-line batch inference, calibration scripts, transformation-chain evaluation, patch analysis, shortcut audits, data-quality checks, and automated tests.

The required JSON output remains: [ { "image_path": "images/example.jpg", "pred": 0.84 } ] We used Python, PyTorch, Hugging Face Transformers, timm, PEFT/LoRA, Pillow, OpenCV, NumPy, SciPy, scikit-learn, pandas, Streamlit, pytest, and Ruff.

The system runs on CPU and Apple MPS. It includes a Streamlit interface, command-line inference, reproducible evaluation scripts, data-quality audits, and automated tests.

Challenges we ran into

The first major challenge was discovering that robustness is not the same as accuracy on clean images. Repeated transformations caused scores to drift toward “authentic,” creating false-negative pressure. A degraded fake could become confidently wrong rather than simply uncertain.

The second challenge was generator-specific generalisation. On 646 held-out images, the base detector achieved recall of 1.000 on SD 2.1, SDXL, SD 3, and Midjourney, but only 0.305 on ADM. It missed seven of ten ADM examples.

Our analysis suggests that the detector learned signals associated with latent-diffusion pipelines, including traces introduced during VAE decoding. ADM is a pixel-space diffusion model and does not produce the same type of signature. This means the detector was not learning “AI-generated” in a completely generator-independent way; it was learning a strong but incomplete shortcut tied to certain image-generation pipelines.

The third challenge was data confounding. In the raw sources, generated images were almost always square while authentic images usually were not. A model could have learned that “square means fake,” producing nearly perfect-looking results for the wrong reason. We detected the issue, removed the confound, measured the residual file-size signal at AUC 0.685, and found the same defect in the official benchmark’s specification-faithful configuration.

Accomplishments that we're proud of

  • Built an end-to-end image-detection prototype around a 740-million-parameter model.

  • Evaluated robustness across realistic transformations and multi-step degradation chains.

  • Added calibration, fixed-threshold evaluation, consistency scoring, and safe abstention.

  • On benchmark subsets, abstention achieved 1.000 accuracy among answered images on both evaluations, while abstained images were 2.20× and 2.57× more error-prone than the overall population.

  • Identified the detector’s major ADM weakness instead of hiding it behind aggregate accuracy.

  • Demonstrated that a generator-focused head-training experiment improved ADM recall from 0.305 to 0.863 and pixel-space performance from 0.519 to 0.914, at the cost of a 0.059 increase in false positives.

  • Tested the same adapted approach on DALL·E benchmarks and found that the original model won 13 of 14 conditions at matched false-positive rate.

  • Kept the original checkpoint as the default because the improvement was conditional rather than broadly reliable.

  • Detected and quarantined six conflicting-label pairs affecting 12 files.

  • Found zero exact cross-split duplicates in the audited dataset.

  • Tested patch analysis and removed it from probability scoring when it reduced performance.

  • Preserved the required {image_path, pred} output contract.

  • Reached 487 passing tests with clean Ruff and compilation checks.

What we learned

The most important lesson was that a detector can appear excellent while still failing on a specific generation family.

Our base model performed perfectly on the tested SD and Midjourney families but struggled badly on ADM. This was not just a disappointing metric; it revealed a mechanism. The model had learned evidence that survives from some latent-diffusion pipelines, but that evidence was absent or different in pixel-space diffusion.

We also learned that improving one domain can damage another. Training a head on a six-generator dataset substantially improved ADM performance, but the adapted model lost against the original on most DALL·E benchmark conditions when compared at the same false-positive rate. We therefore treated the experiment as evidence of conditional specialization, not as proof that fine-tuning solved generalisation.

The same principle guided our handling of image shortcuts. Dataset structure, file format, dimensions, and file size can all create misleading performance. Robust evaluation requires testing whether the model still works after those signals are controlled.

Finally, we learned that abstention can be more useful than pretending to know. When evidence becomes unreliable, a responsible detector should be able to say “uncertain” instead of confidently labelling an image as authentic.

What's next for RobustLens

The next version should focus on generator diversity and locally edited images. We would collect larger datasets containing pixel-space diffusion, latent diffusion, commercial generators, and unseen generators, with strict source separation. We would also evaluate camera models separately and add reliable edit masks for localized AI-edit detection.

Future work would include: 1) training with broader generator coverage; 2) validating whether ADM-specific improvements transfer to unseen pixel-space models; 3) calibrating thresholds separately for different deployment objectives; 4) expanding the abstention benchmark beyond the current sample sizes; 5) comparing 4-, 9-, and 16-patch configurations; 6) adding independent camera-origin and provenance evidence; and 7) testing against more realistic chained redistribution pipelines.

RobustLens is not a proof system and does not detect every AI-generated or AI-edited image. Its most trustworthy role is to provide an evidence-based likelihood, identify where the detector is weak, especially on ADM, and make it possible to say “we do not know” when the available evidence is insufficient.

Built With

Share this project:

Updates

Submission history