SlopDet

SlopDet is a powerful tool to assist users in ascertaining if images are synthetic or not, with plain-language explanations to suspicious indicators of AI-generation.

Comment 2

SlopDet

Problem Statement

The sheer power and availability of modern Generative AI tools have made it easier than ever before to create synthetic images at a hitherto unprecedented scale. On the other hand, false accusations of publishing AI content are harmful to genuine content creators. This erosion of trust in digital content poses numerous challenges to online platforms, especially when compounded with humans’ historically close-to-coinflip levels of accuracy of distinguishing synthetic and organic content.

We aim to address this problem by introducing our tool SlopDet, with the intent of enhancing a user’s acumen.

Product Overview

SlopDet is a tool that leverages state-of-the-art vision-language models to generate its own analysis of an image. Rather than simply classifying each image as Organic/Synthetic, we provide a confidence score of the classification, and more importantly, directly overlay a heat map onto the image to highlight the most relevant patches to the classification. We reinforce this by using a general-purpose VLM to explain patch-level contributions using natural language. The result is a proof-of-concept that showcases the promise of making visual AI detection transparent beyond a numeric score.

Key Features & Deliverables

  • Broad Dataset Curation & Data Synthesis for diverse and high quality training and evaluation data

  • Synthetic/Organic Classification reported with confidence score

  • Heatmap Overlay displayed onto source image

  • VLM-generated Explanations for high-relevance patches

- Robustness Evaluation & Ablation Study to scientifically assess our approach

SlopDet's amazing and godlike poster

Development

Datasets:

APIs used:

Training:

  • SigLIP backbone with LoRA-finetuning augmented with an MLP + QFormer head
  • Online image augmentation during training to dynamically generate more data points

Challenges

We applied a highly data-driven approach to address this problem, to leverage the sheer power of modern image-text models (in our case, SigLIP). Our fundamental approach is a LoRA-finetuned SigLIP backbone, augmented with a QFormer+MLP head, and although we encountered several difficulties along the way, we managed to overcome many of these issues through a combination of clever methodology tweaks and dataset augmentations. We list below a few examples of the challenges we encountered over several iterations of our model and how we addressed them:

  • Early iterations of our models struggled against adversarial datasets we curated containing highly out-of-distribution samples. For example, one of the first iterations struggled greatly with very low-resolution images. We addressed this by enriching our training dataset with these characteristics. This process of inspecting our failure cases and enhancing our training dataset with underrepresented categories formed the backbone of our approach. Similar cases happened for images of underrepresented provenances, images with extreme resolutions, and countless other unforeseen categories that emerged during error analysis.

  • As mentioned earlier, online augmentation of the training data as we trained the model allowed us to generate a much richer training dataset than the source dataset size would suggest. Compared to augmenting the dataset offline, which would also have been prohibitively space-consuming, it allowed our model to train on a robust range of augmentations and even combined augmentations (i.e. Blur + Compression at the same time). This much higher quality of training proved to hold up better as we applied it to increasingly adversarial validation tests.

  • Another problem was the model learning strange semantic shortcuts, such as biasing selections based on dimensions due to the noticeably uneven distributions of dimensions between real and AI images that emerged as we explored various datasets. By taking great care to even out the training distributions (as seen in the plots below), we avoided this problem and forced the model to classify the images based on meaningful signals instead.

Dimension comparison

Accomplishments

  • Our augmentations and fine-tuning yielded beyond fantastic results on the sample data, with over 98% accuracy on the sample test set, while only incurring an additional 10-15% overhead in model parameters with respect to the SigLIP 2 base model due to the use of parameter efficient fine-tuning techniques like LoRA. The entire training process required less than 5 GPU hours and can be performed on a single NVIDIA L40.

  • Our approach further yields strong results, with F1 scores oftentimes larger than 95% on various test sets that we compiled, succeeding in detection across resolutions, content and even identifying images that are not purely synthesised but tampered by AI. See Robustness Evaluation below for the full breakdown.

  • Heatmap augmentation beautifully reveals exactly where the attention is focused, peeling back the veil covering an otherwise black-box solution

Robustness Evaluation

We evaluated the detector on four benchmarks (~82k images), each probing a different axis of difficulty:

Benchmark Real (negative) Fake (positive) Images What it tests
General Our validation split Our validation split 33,871 In-distribution reference. Image dimensions and content are matched across both classes, so size and subject-matter shortcuts are unavailable
Actual COCO val2017 DALL·E 3 "Advanced" 8,717 Transfer to external real and synthetic sources, closest proxy for production traffic
CIFAKE CIFAKE test (real) CIFAKE test (generated) 20,000 32×32 stress test with almost no high-frequency signal left to exploit
SID-Tamper SID validation SID AI-tampered 20,000 Localised AI editing of otherwise-authentic photos, rather than whole-image synthesis

Each benchmark is run clean and under 20 perturbations that mimic re-sharing online: JPEG (q = 90/70/50/30), Gaussian blur (σ = 0.5/1/2), downscaling (×0.5/×0.25), Gaussian noise (σ = 0.02/0.05/0.1), colour jitter (brightness/contrast/saturation ×0.8 and ×1.2, plus random) and cropping (0.8 of frame).

Results (F1 / AUC; perturbation rows are means over the variants in that family):

Condition General Actual CIFAKE SID-Tamper
Clean 0.9843 / 0.9915 0.9924 / 0.9949 0.9598 / 0.9835 0.9617 / 0.9835
JPEG (q 90–30) 0.9811 / 0.9894 0.9904 / 0.9958 0.9474 / 0.9784 0.9677 / 0.9868
Blur (σ 0.5–2.0) 0.9796 / 0.9889 0.9875 / 0.9943 0.9258 / 0.9679 0.9605 / 0.9839
Downscale (×0.5, ×0.25) 0.9798 / 0.9892 0.9873 / 0.9939 0.9198 / 0.9593 0.9629 / 0.9845
Noise (σ 0.02–0.1) 0.9756 / 0.9862 0.9904 / 0.9958 0.9282 / 0.9769 0.9614 / 0.9844
Colour jitter (7 settings) 0.9825 / 0.9907 0.9860 / 0.9942 0.9518 / 0.9808 0.9502 / 0.9785
Crop (0.8) 0.9744 / 0.9858 0.9899 / 0.9943 0.9391 / 0.9755 0.9633 / 0.9849
Mean (all 20) 0.9801 / 0.9891 0.9880 / 0.9948 0.9396 / 0.9754 0.9588 / 0.9828
Worst F1 0.9675 (noise σ=0.1) 0.9783 (brightness ×1.2) 0.8936 (noise σ=0.1) 0.9238 (brightness ×1.2)

Key takeaways

  • Perturbations that destroy high-frequency signal (noise, blur, downscaling) hurt most. Those that only change geometry or palette (crop, jitter) barely register. This is the profile of a detector reading generation artefacts, not image dimensions or content.
  • On external sources at native resolution (Actual), the whole suite spans roughly one F1 point, and heavy JPEG/noise cause no degradation at all.
  • At 32×32 (CIFAKE), AUC holds up far better than F1, so most of the loss is threshold calibration rather than lost ranking ability and is recoverable without retraining.
  • AI-tampered images are detected almost as well as fully synthetic ones, so a single model covers both threat models without a separate localisation stage.

Full report with per-variant numbers and discussion: Robustness Evaluation Summary Report.

Ablation Study

We perform an ablation study to compare the performance of our proposed approach (SigLIP2 + LoRA + QFormer + MLP) against two other approaches: a naive SVM/logistic regression using SigLIP features, and a classical FFT+GLCM SVM/RBF approach. The evaluation is conducted on two datasets: COCO VAL 2017 (Real) + DALLE3-Advanced (Fake) and CIFAKE Test (Real) + CIFAKE Test (Fake). We chose the CIFAKE dataset in addition to the given test set as the CIFAKE dataset has images with extremely low (32 x 32) resolution, which serves as a good stress test. All models are trained on the same dataset as described in other parts of our post. We evaluate the models under various image transformations, including JPEG compression, Gaussian blur, cropping, and resizing.

The reported values are AUROC scores, i.e. the area under the receiver operating characteristic curve, which is a measure of how well the model can distinguish between real and AI-generated images. A score of 1.00 indicates perfect classification, while a score of 0.50 indicates random guessing.

Evaluation Dataset: COCO VAL 2017 (Real) + DALLE3-Advanced (Fake)

Method Clean JPEG q30 Blur σ=2 Crop 80% Resize 0.25
(a) SigLIP2 + LoRA + QFormer + MLP 1.00 1.00 1.00 1.00 1.00
(b) Naive SVM/logreg SigLIP2 0.99 1.00 0.98 0.98 0.99
(c) Classical FFT+GLCM SVM/RBF 0.87 0.48 0.87 0.57 0.87

Evaluation Dataset: CIFAKE Test (Real) + CIFAKE Test (Fake)

Method Clean JPEG q30 Blur σ=2 Crop 80% Resize 0.25
(a) SigLIP2 + LoRA + QFormer + MLP 0.99 0.99 0.97 0.99 0.96
(b) Naive SVM/logreg SigLIP2 0.89 0.85 0.80 0.86 0.78
(c) Classical FFT+GLCM SVM/RBF 0.90 0.85 0.62 0.78 0.62

From the ablation, we hypothesise that a deep learning approach is more likely to lead to better performance in and out of distribution. With more time and resources, a complete ablation to determine the core components that drive the success of our approach would be the natural next step.

Built With

Share this project:

Updates

Submission history