TraceGuard

AI generated image
Real image

Inspiration

AI-generated images are becoming easier to create and harder to recognize. However, many detectors that report near-perfect validation accuracy fail when tested on images from a different generator, dataset, resolution, or compression pipeline.

While developing TraceGuard, we saw this problem directly: a detector could achieve over 99% validation ROC-AUC and still reverse its predictions on an unfamiliar dataset. That inspired us to build something more transparent than a simple “real or fake” classifier—a forensic screening tool that also reveals when its own decision is unstable.

What it does

TraceGuard analyzes an uploaded image and returns:

A detector score and real/AI-generated verdict
The exact decision threshold used by the model
A stability test across JPEG compression, blur, resizing, and cropping
A warning when the result is sensitive to redistribution
Batch scoring with downloadable JSON results
Optional multi-model and frequency-analysis experiments

TraceGuard is designed as a research and screening tool, not as proof that an image is authentic or AI-generated. Its purpose is to surface forensic evidence and uncertainty instead of hiding them behind a confident label.

How we built it

TraceGuard is built with Python, PyTorch, timm, Hugging Face datasets, and Gradio.

We implemented and compared three main architectures:

DINOv2 with register tokens using its native class-token representation
DINOv3-S/16 using the class token, patch-token mean, and patch-token standard deviation
DINOv3 with an explicit frequency branch containing radial FFT and color statistics

The models are fine-tuned end-to-end using a low learning rate of (10^{-6}). To preserve forensic traces, images are cropped at their native resolution instead of always being resized before entering the backbone.

Our training pipeline also includes label-symmetric JPEG, blur, scaling, noise, color, and cutout augmentations. These transformations are applied equally to real and generated images so the detector cannot simply learn that one compression format means “fake.”

We created a balanced research subset of Community Forensics-Small containing:

8,000 real images
8,000 generated images
256 generator groups
At most 32 images from any single generator
No corrupt files or duplicate image hashes

Generator-disjoint validation prevents images from the same fake-image generator from appearing on both sides of the train/validation split.

The most important result

Our experiments showed why AI-image detection remains difficult.

DINOv2 achieved 0.9985 validation ROC-AUC, but only 0.3542 AUC on an unfamiliar SID/WildFake holdout. The model had learned highly effective in-domain signals that did not transfer.

DINOv3 generalized better:

0.9955 AUC on Community Forensics validation
0.5723 AUC on the SID/WildFake holdout
0.6896 AUC on an unseen CIFAKE subset

The frequency branch slightly improved one holdout but reduced CIFAKE AUC to 0.618. This demonstrated that frequency evidence can also become dataset-specific.

We also discovered that ranking and threshold calibration are separate problems. DINOv3 ranked CIFAKE images reasonably well, but its training-domain threshold classified almost every CIFAKE image as generated. TraceGuard therefore displays the threshold and stability behavior instead of treating the score as universally calibrated.

Challenges we faced

Dataset bias

The detector frequently learned differences in image source, resolution, encoding, or semantic content instead of generation artifacts.

Generator diversity

Hundreds of model names did not guarantee coverage of different generation mechanisms. Many were closely related diffusion checkpoints, while architectures such as MAGE, VQGAN, and VQVAE remained difficult.

Limited compute and storage

We trained end-to-end transformer models on an 8 GB RTX 4060. Native crops, mixed-precision training, bounded datasets, and resumable streaming allowed the experiments to fit locally. We also reclaimed approximately 51 GiB by safely removing obsolete training copies.

Honest evaluation

It was tempting to report only the near-perfect validation result. Cross-dataset evaluation revealed a much more important and realistic picture of the detector’s behavior.

What we learned

High validation accuracy does not guarantee cross-dataset generalization.
More generators are useful only when they represent different generation mechanisms.
A better backbone cannot compensate for biased or unpaired training data.
Frequency artifacts can help, but can also become source-specific shortcuts.
ROC-AUC can transfer while the decision threshold fails completely.
A responsible detector needs uncertainty, stability testing, and an abstention mechanism.

What’s next

Our next iteration will:

Balance training data by generator architecture, not just model name
Include semantically paired real and generated images
Add an out-of-distribution detector that can abstain on unfamiliar domains
Calibrate thresholds using untouched multi-domain datasets
Report fixed false-positive-rate operating points
Explore localized patch-level forensic explanations
Combine semantic and pixel-level evidence without relying on static fusion weights

Responsible use

TraceGuard is a non-commercial research prototype. Its output should never be treated as definitive proof or used alone to accuse a person of generating or manipulating an image.

Community Forensics-Small is used under its CC-BY-NC-SA-4.0 license.