PaperlayerView exact revision on arXiv

Source-linked AI summary

CNN-generated images are surprisingly easy to spot... for now

Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, Alexei A. Efros

arXiv:1912.11035v2cs.CV

TL;DR

The paper asks whether one detector can distinguish real images from CNN-generated images across architectures and datasets. It evaluates a ProGAN-trained classifier on 11 diverse generators and finds substantial cross-domain generalization, supported by preprocessing and augmentation. The results indicate that current CNN-generated images retain detectable fingerprints, while future convergence and practical deployment conditions limit the conclusion.

  • Problem

    The paper asks whether a universal detector can distinguish real images from CNN-generated images regardless of architecture or dataset.

  • Method

    The authors train a binary classifier on ProGAN-generated images and real training images, then evaluate it across 11 CNN synthesis models and datasets.

  • Results

    The ProGAN-trained classifier generalizes across datasets, architectures, and tasks, including the subsequently released StyleGAN2, when preprocessing and augmentation are handled appropriately.

  • Takeaways & Limitations

    Today’s CNN-generated images retain detectable fingerprints that allow forensic classifiers to transfer between models without extensive adaptation.

  • Takeaways & Limitations

    The conclusion may not persist if GAN generators reach convergence, and current detectors remain exposed to hand-picked fakes and more aggressive real-world transformations.

Abstract

from arXiv · show

In this work we ask whether it is possible to create a "universal" detector for telling apart real images from these generated by a CNN, regardless of architecture or dataset used. To test this, we collect a dataset consisting of fake images generated by 11 different CNN-based image generator models, chosen to span the space of commonly used architectures today (ProGAN, StyleGAN, BigGAN, CycleGAN, StarGAN, GauGAN, DeepFakes, cascaded refinement networks, implicit maximum likelihood estimation, second-order attention super-resolution, seeing-in-the-dark). We demonstrate that, with careful pre- and post-processing and data augmentation, a standard image classifier trained on only one specific CNN generator (ProGAN) is able to generalize surprisingly well to unseen architectures, datasets, and training methods (including the just released StyleGAN2). Our findings suggest the intriguing possibility that today's CNN-generated images share some common systematic flaws, preventing them from achieving realistic image synthesis. Code and pre-trained networks are available at https://peterwang512.github.io/CNNDetection/ .

1. Introduction

The paper asks whether a detector trained on one CNN generator can identify synthetic images across architectures and datasets. Using a ProGAN-trained classifier, it finds substantial cross-model generalization and studies the factors supporting it.

  • CNN image synthesis raises concern that distinguishing real from generated images may become impossible.
  • Technique-specific detectors can fail on new datasets or become obsolete as generation methods evolve.Dataset bias can limit transfer from faces to cars, while changing synthesis methods can invalidate the detector.
  • The paper investigates whether common CNN fingerprints enable classifiers to generalize across generation methods rather than only one technique.
  • A binary classifier trained on ProGAN fakes and their real training images generalizes across datasets, architectures, and tasks.
  • The ForenSynths dataset contains synthesized images from 11 models spanning unconditional generation, super-resolution, and deepfakes, with different task-specific datasets.The detector also works out-of-the-box on the subsequently released StyleGAN2.
  • Common post-processing augmentation is critical for generalization, while diverse and sufficiently large training data improve performance up to a point.With appropriate procedures, classifiers remain robust to JPEG compression, blurring, and resizing.
  • The paper contributes cross-method generalization findings, the ForenSynths dataset and evaluation metric, and experiments analyzing generalization factors.

2. Related work

Prior work established detectors for specific CNN manipulations but reported weak transfer across models and datasets. Related research also identifies architectural artifacts, including sampling and upsampling defects, that may reduce CNN representational power.

  • Earlier face-manipulation and image-translation detectors demonstrated same-model detection but did not study cross-model or cross-dataset transfer.
  • Cozzolino et al. reported near-chance transfer between models and pursued representation learning for zero- and low-shot transfer across CNN and non-CNN generators.
  • Traditional image forensics uses cues such as compression artifacts, resampling, and physical scene constraints, alongside supervised learning methods.
  • Common CNN designs contain artifacts that reduce representational power, with substantial prior focus on upsampling and downsampling.
  • Reported CNN artifacts include checkerboard patterns from deconvolution, reduced translation invariance from strided convolutions, aliasing, and limited GAN generation capacity.

3. A dataset of CNN-based generation models

The authors build a dataset spanning 11 CNN synthesis models, varied architectures, datasets, losses, and tasks. They standardize collection and preprocessing to evaluate transfer across generators using average precision.

  • The dataset contains 11 synthesis models selected to span varied CNN architectures, datasets, and losses, all using upsampling-convolutional structures.
  • The collection covers unconditional GANs including ProGAN, StyleGAN, and BigGAN, plus conditional translation models CycleGAN, StarGAN, and GauGAN.
  • It also includes perceptual-loss models CRN and IMLE, low-level vision models SITD and SAN, and FaceForensics++ DeepFake images.
  • DeepFake is treated as an out-of-distribution test case because its faces undergo extensive post-processing, including Poisson blending with real content.
  • Fake images are collected using each model’s preprocessing, while equal numbers of real training images receive the corresponding pipeline to align real and fake distributions.
  • The dataset uses a common 256×256 resolution when possible, rescales lower-resolution outputs, preserves higher-resolution outputs, and predicts from 224 × 224 crops.
  • Table 2 compares baseline and proposed classifiers across 11 generators, distinguishing generalization results from cases where test generators were used during training.Mean AP averages AP scores over all datasets; chance is 50% and best possible performance is 100%.

4. Detecting CNN-synthesized images

The paper trains a ProGAN-based real-or-fake classifier and evaluates whether it generalizes across CNN generators, datasets, and tasks. Augmentation, training-image diversity, and robustness experiments show strong but qualified transfer, including to StyleGAN2.

  • Training classifiers: The study trains a ResNet-50 binary classifier on ProGAN-generated and real images, then tests generalization to other CNN-synthesized images.The training set contains 720K images across 20 LSUN categories, with equal real and fake examples.
  • Training classifiers: Training with more image classes improves AP up to a point, while model comparisons show better generalization than Zhang et al. [50] for most other architectures.Exceptions include CycleGAN, StarGAN, and SAN under augmentation.
  • Training classifiers: Aggressive simulated post-processing improves cross-generator generalization even when test images are not post-processed.The evaluation uses average precision (AP), and augmentation also improves robustness to post-processing.
  • Training classifiers: 93.6 AP on SAN and 98.2 AP on DeepFake without augmentation decrease when augmentation is applied, although reduced-rate Blur+JPEG preserves DeepFake detection at 89.0 AP.The paper attributes SAN’s sensitivity to reliance on high-frequency cues and treats DeepFake as an out-of-distribution case.
  • New CNN models: 99.1% AP is achieved on StyleGAN2 across LSUN car, cat, church, and horse variants using the Blur+JPEG (0.1) model.The result supports transfer to a newer generator with redesigned normalization, multi-resolution, and regularization methods.
  • Qualitative analysis: Prediction confidence shows little correlation with visual quality on most datasets, suggesting the detector more likely relies on low-level CNN artifacts.A weak correlation appears for BigGAN and StarGAN, but not across the other datasets.
  • Qualitative analysis: Frequency spectra reveal periodic patterns in most synthetic images, whereas BigGAN and ProGAN contain relatively few such artifacts.The repeated patterns may be consistent with aliasing artifacts, while real-image spectra generally look alike across datasets.

5. Discussion

CNN-generated images retain detectable fingerprints that let forensic classifiers generalize across models without extensive adaptation, but this advantage may not persist and does not solve visual disinformation alone.

  • CNN-generated images retain detectable fingerprints that distinguish them from real photos and support cross-model forensic generalization.
  • Current detector performance may not persist if GAN architectures become optimized to convergence, potentially making synthetic images indistinguishable from real ones.
  • Single-image attackers can hand-pick fakes that pass a detector’s threshold because detection necessarily trades off true detection and false-positive rates.
  • In-the-wild platform transformations remain insufficiently evaluated, despite demonstrated robustness to some JPEG compression, blurring, and resizing.
  • Detecting fake images is only one component of combating visual disinformation, alongside technical, social, and legal strategies.

A. Additional Analysis

Ranking images by the classifier’s fakeness score separates real from synthetic images, while score quality correlation is generally weak except for BigGAN and StarGAN.

  • The classifier clearly separates real and fake images in ranking, assigning lower fakeness scores to real images and higher scores to synthetic images.
  • Super-resolution SAN outputs rank as more real, whereas CRN and IMLE outputs rank as more fake.
  • Classifier predictions show little noticeable correlation with synthesized-image visual quality within datasets, except for BigGAN and StarGAN.

A.2. Effect of dataset size

Dataset-size ablations evaluate classifiers trained on progressively larger subsets while preserving all 20 LSUN classes, showing that generalization declines less than in the dataset-diversity comparison.

  • Four additional models use 10%, 20%, 40%, and 80% of the full dataset while retaining all 20 LSUN classes.
  • All dataset-size models use the same Blur+JPEG (0.5) augmentation scheme.
  • The dataset-size ablation produces much less reduction in generalization performance than the dataset-diversity ablation.

A.3. Comparison to training on a different model

The paper evaluates classifiers trained on BigGAN images alongside other baselines across 11 generators, using average precision as the comparison metric.

  • A classifier trained solely on BigGAN uses 400k BigGAN fakes and 400k class-matched ImageNet real images.
  • The BigGAN-trained classifier uses the Blur+JPEG (0.5) augmentation scheme and exhibits cross-model generalization.
  • Additional evaluations compare baseline models, DIP- and BigGAN-trained classifiers, and dataset-size variants across 11 generators using average precision.

A.4. Training with images generated with a deep image prior

The paper tests whether deep image prior reconstructions can provide a broader source of fake images for detector training. Although this model underperforms direct ProGAN training, it detects several unseen datasets, suggesting shared low-level artifacts are present but insufficient alone for general detection.

  • A.4. Training with images generated with a deep image prior: The method reconstructs each synthesized image with a separately trained deep image prior network by minimizing ℓ1 loss.The reconstructed image f(θ_i) is treated as a fake image, with optimization using Adam and a decreasing learning rate.
  • A.4. Training with images generated with a deep image prior: Training uses 44k ImageNet real images and ProGAN deep image prior reconstructions optimized for six iteration counts, with real images oversampled sixfold.The same training configurations and augmentations as Blur+JPEG (0.5) are used.
  • A.4. Training with images generated with a deep image prior: The deep-prior model performs worse than direct ProGAN training but detects StarGAN, CRN, SITD, and SAN datasets.These results indicate that low-level artifacts are shared across methods, while exploiting them alone may not suffice for general detection.
  • A.4. Training with images generated with a deep image prior: The study compares its detector with Zhang et al., Nataraj et al., and Cozzolino et al. using additional GAN-detection baselines.The comparisons include different training strategies and, for Cozzolino et al., the ProGAN/CycleGAN model.

A.6. Other evaluation metrics

The evaluation supplements threshold-less AP with accuracy, precision-recall analysis, calibration, and an internet-sourced proxy test. Performance remains above chance under resizing and JPEG compression, but heavy resizing reduces it.

  • A.6. Other evaluation metrics: The evaluation reports uncalibrated accuracy, oracle accuracy, and two-shot calibration using two examples from the test distribution.Two-shot calibration fits a logistic regression to logits from 128 random crops of one real-fake pair.
  • A.6. Other evaluation metrics: AP is defined as the area under the precision-recall curve, with higher AP indicating a better precision-recall trade-off.Figure 8 reports PR curves for each dataset from the Blur+JPEG (0.1) model.
  • A.6. Other evaluation metrics: 83.6% accuracy and 93.2% AP are achieved without resizing on the internet proxy test, falling to 74.9% accuracy and 82.6% AP after resizing.The proxy contains 1k real and 1k StyleGAN-generated faces compressed into JPEG; both settings remain above the 50% chance accuracy baseline.
  • A.6. Other evaluation metrics: The detector achieves comparable AP to Zhang et al. while generalizing across methods without training on CycleGAN images.The CycleGAN testcase reports performance well above chance for each category.

B.1. Dataset Collection

The ForenSynths dataset contains images from 11 synthesis models selected to span varied CNN architectures, datasets, and losses. It includes unconditional generation, image translation, super-resolution, deepfakes, and related tasks.

  • B.1. Dataset Collection: The dataset includes ProGAN, StyleGAN, StyleGAN2, BigGAN, CycleGAN, StarGAN, GauGAN, CRN, IMLE, SITD, SAN, and DeepFake data sources.The collection uses officially released models or repository outputs, with task-specific real and synthetic images.
  • B.1. Dataset Collection: StyleGAN and StyleGAN2 samples use released models trained on LSUN categories, with synthesized images generated using 0.5 truncation.The listed resolutions vary by category, including 256 × 256 and 512 × 384.
  • B.1. Dataset Collection: Table 5 evaluates uncalibrated, two-shot, and oracle classifier accuracy, while Table 6 reports uncalibrated accuracy for each CycleGAN category.The CycleGAN evaluation remains above the 50% chance level without direct CycleGAN training.
  • B.1. Dataset Collection: SITD data use Sony and Fuji camera datasets, with real and synthetic images directly generated from released code.SAN uses ground truth and official 4× super-resolution predictions from Set5, Set14, BSD100, and Urban100.
  • B.1. Dataset Collection: DeepFake data consist of cropped faces extracted from manipulated and original video frames in validation and test splits.Faces are detected and cropped from the Deepfakes dataset sequences.

B.2. Training details

Classifier training uses Adam with scheduled learning-rate reductions and termination at a minimum learning rate of 10^-6.

  • B.2. Training details: Classifiers are trained with Adam, β1 = 0.9, β2 = 0.999, batch size 64, and initial learning rate 10^-4.The learning rate is reduced by 10× when validation accuracy fails to improve by 0.1% after five epochs, and training stops at 10^-6.
Loading 1912.11035v2…