AI-Generated Image Detector

Inspiration

AI-generated images are becoming increasingly realistic, while most detectors perform well only when test images resemble their training data. In practice, images are compressed by social-media platforms, resized, cropped, blurred, colour-adjusted or captured from generators the detector has never seen.

This inspired a detector that does not rely on a single obvious visual artefact. The goal was to combine complementary evidence, remain reliable after common transformations and improve generalisation to unseen generators.

What it does

AI-Generated Image Detector predicts the probability that an image is AI-generated.

It examines each image through three complementary views:

Semantic evidence: CLIP identifies inconsistencies in objects, composition and visual meaning.
Edge evidence: a Laplacian high-pass view highlights unusual local textures and boundaries.
Frequency evidence: a centred FFT representation exposes patterns that may be invisible in ordinary pixel space.

The detector is trained and evaluated against JPEG compression, Gaussian blur, resizing, noise, colour changes and cropping. A calibrated probability is returned rather than only a binary label, making the output more useful for ranking and downstream moderation systems.

A Streamlit interface supports individual images, batches and multiple trained checkpoints.

How we built it

The project began with a frozen CLIP ViT-B/32 encoder and an EfficientNet-B0 forensic encoder. Experiments showed that combining Laplacian and FFT views was more reliable than using either forensic signal alone.

Both large encoders remain frozen. Only an approximately 820,000-parameter fusion head is trained, keeping the complete inference model at roughly 93 million parameters—well below the competition’s two-billion-parameter limit.

Training uses deterministic clean and transformed views of each original image. The optimisation objective combines classification, consistency and worst-transformation-group losses: $$L = L_{\text{classification}} + \lambda_c L_{\text{consistency}} + \lambda_w \max_g L_g$$ This encourages predictions to remain stable across transformations while preventing strong performance on easy conditions from hiding weaknesses on harder ones.

The data pipeline grew from a 5,000-image prototype to a balanced 40,000-image CIFAKE and SID_Set corpus. It was subsequently expanded to a 65,982-image generator-diverse corpus containing ImageNet real images and synthetic images from DDIM, DDPM, BigGAN and StyleGAN. ADM was reserved as a generator-held-out model-selection source. These datasets are all in the contained in the WildFake dataset collection.

Every experiment uses persisted train, model-selection, calibration and reserved-test splits. Exact hashes, perceptual hashes and duplicate groups are audited to prevent related images from crossing split boundaries. Temperature calibration is performed on a separate calibration split.

Feature extraction and training were accelerated on an NVIDIA RTX 4090 by caching the outputs of the frozen encoders. This allowed controlled comparison of augmentation policies, dropout, fusion strategies, initialisation checkpoints and generator-diverse retraining without repeatedly processing every image.

Challenges we ran into

Generalising beyond familiar generators

Early models achieved excellent results on held-out CIFAKE and SID_Set images but performed much worse on unseen generators. This revealed that transformation robustness and generator generalisation are separate problems. Adding more images from familiar sources was not enough; generator diversity mattered significantly more.

Avoiding dataset shortcuts

CIFAKE images are only 32×32, while SID_Set images are generally high-resolution. A model could therefore learn dataset or resolution signatures instead of genuine generation artefacts. Sources were balanced across labels, source-level audits were added and generator-held-out evaluations were introduced to expose these shortcuts.

Preventing data leakage

Large image datasets contain exact copies, resized versions and perceptually similar images. Random splitting could produce misleadingly high results. The pipeline therefore keeps duplicate groups atomic and rejects cross-split exact and perceptual conflicts.

Surviving image transformations

Forensic artefacts can disappear after heavy blur, JPEG compression or downscaling. Balanced transformation scheduling, paired consistency training, robust checkpoint selection and complementary semantic/frequency evidence were needed to reduce this weakness.

Choosing between increasingly complex models

A three-expert adaptive ensemble appeared promising but was slightly weaker than the simpler Laplacian-and-FFT fusion model. This reinforced the importance of controlled experiments instead of assuming that a more complicated architecture will perform better.

Managing large experiments

Datasets, feature caches and checkpoints were too large for Git and were trained across Apple Silicon, CPU and RTX 4090 environments. Reproducible manifests, checkpoint hashes, resumable stages and environment-specific setup scripts became essential.

Accomplishments that we're proud of

Scaled from a 5,000-image prototype to a balanced, audited 65,982-image generator-diverse corpus.
Improved mixed-40K clean accuracy from 97.34% to 98.33%.
Improved mean transformed accuracy from 94.80% to 95.99% across 15 transformed conditions.
Achieved 98.62% clean accuracy and 96.13% mean accuracy across all 16 conditions on the locked mixed-40K reserved test.
Increased external GLIDE ROC-AUC from 0.6877 to 0.9078 through WildFake-diverse retraining.
Increased GLIDE balanced accuracy from 0.5537 to 0.7458.
Preserved a compact trainable component by optimising only the 820K-parameter fusion head.
Built duplicate-aware splitting, calibration, exact-severity evaluation, shortcut auditing and per-source error analysis.
Developed a complete inference interface while preserving the required calibrated probability output.

What we learned

High same-source accuracy does not prove that a detector understands AI generation. A model can be highly robust to JPEG compression and blur while still failing on a new generator.

Generator diversity was more valuable than simply increasing the number of images from familiar datasets. The strongest cross-generator improvement came from training on multiple generator families while holding out ADM for model selection.

Semantic and forensic evidence are complementary. Semantic features remain useful when post-processing damages pixel-level artefacts, while Laplacian and FFT views detect subtle local and frequency patterns that semantic models may overlook.

Calibration, split design and leakage auditing are as important as architecture. A strong score is meaningful only when the model-selection, calibration and final-test boundaries are preserved.

Finally, simpler models can outperform more elaborate ensembles. Experimental discipline and honest evaluation produced more progress than complexity alone.

What's next for AI-Generated Image Detector

Future work will include:

adding more recent generator families without contaminating external benchmarks;
improving performance under aggressive resizing and JPEG compression;
reducing native-resolution and source shortcuts;
exploring generator-aware sampling and lightweight expert fusion;
improving inference speed and memory efficiency;
expanding explanations to show which semantic, edge or frequency evidence influenced a prediction;
packaging the calibrated model and its exact checkpoint hash for reproducible deployment.

Appendix: exploring reconstruction error for AI-image detection

Alongside the main detector, we explored a separate question: if diffusion models generate synthetic images, can a generative model also help identify them? A pretrained diffusion model or autoencoder has learned a constrained representation of images. A generated image may sit closer to that learned image space than a photograph, or fail to reconstruct in a systematically different way. When either image is passed back through the model, those differences may appear in the residual's texture, edges or frequency content. This provides a forensic signal that is complementary to asking a discriminative encoder what the image depicts.

This direction was motivated by reconstruction-based research including DIRE, which uses diffusion inversion and reconstruction error; LaRE, which examines latent reconstruction error; and FIRE, which learns from frequency-guided VAE reconstruction errors. The shared intuition is that even when a generated image looks convincing, its relationship to a generative model's learned image space may leave measurable traces.

Our early diffusion experiments were mixed. A short diffusion-and-reconstruction cycle did not clearly improve an existing detector, while a 20-step inversion and 20-step reconstruction experiment produced interesting partial frequency results but was stopped before it could support a complete held-out conclusion. The approach was also computationally unattractive for this project: the latter required 40 UNet evaluations per image, ran at a median of about 1.31 seconds per image, and took roughly 72.8 minutes for a 3,200-reconstruction robustness pilot. That is difficult to justify against fast, single-pass detectors.

We therefore investigated the cheaper VAE bottleneck directly: encode an image once, decode it once, and analyse the reconstruction residual, including its Fourier spectrum. Although this produced strong results in some early evaluations, later experiments reinforced the need for source-controlled and generator-held-out testing. Frequency-based residual scores were also sensitive to smoothing operations such as strong blur and downscaling, particularly when using a threshold calibrated only on clean images.

Recent DINOv2 and VAE experiments

The most recent study combined DINOv2's semantic representation with two views derived from a Stable Diffusion 1.5 VAE. It used only 4,000 balanced SID_Set training images—2,000 real and 2,000 synthetic—expanded into 16,000 fixed clean and transformed views. The large DINOv2 and VAE components remained frozen; only compact adapters, image encoders and detection heads were trained.

The first stage constructs three complementary signals from the same image:

                              Input image
                                   |
                 +-----------------+-----------------+
                 |                                   |
                 v                                   v
          Frozen DINOv2-S                    Frozen SD1.5 VAE
                 |                                   |
                 |                            Reconstruction
                 |                                   |
                 |                        +----------+----------+
                 |                        |                     |
                 v                        v                     v
        Semantic features        Reconstruction image    Image - reconstruction
                                                              |
                                                              v
                                                        FFT spectrum

Small trainable components then encode and fuse those signals:

  Semantic features ----> DINO adapter --------> 256 values --+
                                                               |
  Reconstruction image -> small RGB CNN -------> 128 values --+--> Fusion MLP --> AI probability
                                                               |
  FFT spectrum ---------> small spectral CNN --> 128 values --+

The first validation used held-out SID_Set images: the same dataset that supplied the training images, but not the same individual samples. These results therefore measure same-dataset validation, not generalisation to a new source or generator. Averaged across three training runs, adding the reconstruction branch increased clean AUROC slightly from 0.999199 for the DINOv2 MLP to 0.999836. Mean AUROC across 15 transformed conditions similarly increased from 0.999076 to 0.999802. The full three-branch ensemble was marginally weaker at 0.999813 clean AUROC, while the FFT-only branch reached only 0.834941. Reconstruction therefore appears to add a small complementary signal on SID_Set, but FFT does not yet justify its additional complexity.

We also tested cross-generator transfer. SID_Set's synthetic images were generated with FLUX, while the external WildFake evaluation contained 3,998 COCO real images and 7,843 advanced DALL-E 3 images. No WildFake images were used for training or tuning. The following values are again means across three trained models:

Detector variant	WildFake AUROC	Balanced accuracy using the SID_Set threshold
DINOv2 linear	0.937132	0.742729
DINOv2 MLP	0.936412	0.729472
Reconstruction only	0.790745	0.574232
FFT only	0.886272	0.691308
DINOv2 + reconstruction	0.930882	0.660098
DINOv2 + FFT	0.944586	0.706817
Reconstruction + FFT	0.859581	0.579791
Full ensemble	0.949054	0.643378

The full ensemble improved ranking AUROC over the DINOv2 MLP by about 0.013 despite the generator shift. Its balanced accuracy was worse, however, because the decision threshold calibrated on SID_Set did not transfer well to WildFake. The disagreement between the same-source and cross-generator ablations also makes it unclear whether reconstruction or frequency information deserves the credit. This is evidence of potential, not yet a reliable deployment result.

We then tested whether that cross-generator ranking signal survived three of the most destructive transformations in the challenge protocol: JPEG quality 30, Gaussian blur at 2.0 and downscaling to 0.25x followed by upscaling. Each condition contained all 11,841 WildFake test images. The transformations were generated deterministically from the label-blind registry, and the same SID_Set-trained checkpoints, temperatures and thresholds were used without WildFake tuning or recalibration.

The three-seed mean AUROCs were:

Detector variant	Clean	JPEG Q30	Blur 2.0	Resize 0.25x
DINOv2 linear	0.937132	0.927882	0.934884	0.874993
DINOv2 MLP	0.936412	0.926935	0.938368	0.889532
Reconstruction only	0.790745	0.797116	0.794707	0.786532
FFT only	0.886272	0.851122	0.813734	0.937407
DINOv2 + reconstruction	0.930882	0.919702	0.933030	0.884371
DINOv2 + FFT	0.944586	0.936259	0.941286	0.892497
Reconstruction + FFT	0.859581	0.864245	0.702510	0.772165
Full ensemble	0.949054	0.942082	0.947066	0.919190

These results show some promise of robustness under a simultaneous generator and post-processing shift. The full ensemble remained the strongest model under severe JPEG compression and blur. Relative to its clean WildFake AUROC, it lost only 0.0070 under JPEG Q30 and 0.0020 under blur 2.0. Aggressive resizing was harder, reducing its AUROC by 0.0299, but this was still a smaller loss than the DINOv2 linear model's 0.0621 drop and the DINOv2 MLP's 0.0469 drop.

The FFT-only result under 0.25x resize is notable: its mean AUROC increased from 0.886272 clean to 0.937407. That does not make FFT the best general detector—it remained much weaker under JPEG and especially blur—but it suggests that VAE residual frequency information can retain or expose useful structure after aggressive resampling. The full model's consistently strong JPEG and blur results, together with its smaller resize degradation, support further investigation of semantic and reconstruction-frequency fusion.

The operating-point limitation remained. Thresholds calibrated on SID_Set continued to produce very high specificity but low sensitivity on WildFake, including the transformed conditions. AUROC robustness therefore indicates that useful ranking information survived; it does not establish that the existing calibrated probabilities or binary decisions are ready for deployment under domain shift. The experiment also covered only three selected transformations and one external synthetic generator family, so a complete perturbation matrix and broader generator evaluation are still needed.

Comparison note: these figures should not be compared directly with the main detector's headline results. This exploratory model used a different training corpus, architecture, test population and evaluation protocol. The table supports comparisons between its rows; it does not establish that any reconstruction model is better or worse than the final product.

These experiments were not used in the final product. They nevertheless point to a plausible future direction: semantic and reconstruction-frequency fusion preserved strong ranking performance across a generator shift, severe JPEG compression and blur, and degraded less than the semantic baselines under aggressive resizing. Its value still needs confirmation across more real-image sources, generator families and the full post-processing matrix, with calibration designed for domain shift. For now, the robustness evidence is promising but not yet sufficient for a deployment claim.