PaperlayerView exact revision on arXiv

Source-linked AI summary

On the detection of synthetic images generated by diffusion models

Riccardo Corvi, Davide Cozzolino, Giada Zingarini, Giovanni Poggi, Koki Nagano, Luisa Verdoliva

arXiv:2211.00680v1cs.CV

TL;DR

Diffusion models can generate highly realistic images, but whether existing detectors can distinguish them from pristine images—especially after compression and resizing—remains an open question. This paper analyzes diffusion-model forensic artifacts and tests existing detectors under ideal and degraded conditions; performance varies by model, and generalization remains the main hurdle.

  • Problem

    Existing synthetic-image detectors, largely developed for GAN images, have limited evidence of generalizing to unseen architectures and images degraded by resizing and compression.

    Source: §1 · p. 2

  • Method

    The authors analyze artifacts in images from a variety of recent generators and evaluate deep-learning detectors in ideal and resized/compressed scenarios.

    Source: §1 · p. 2

  • Results

    Detection performance varied substantially by diffusion model; GAN-only-trained detectors worked poorly on diffusion images, while adding one diffusion model helped on similar models but not others.

    Source: §5 · p. 4, §4 · p. 4

  • Takeaways & Limitations

    Generalization remains the main hurdle because diffusion models exhibit different forensic cues and training with one model may not transfer to others.

    Source: §5 · p. 4

    The authors characterize these as preliminary results and state that deeper analyses are necessary.

    Source: §5 · p. 4

Abstract

from arXiv · show

Over the past decade, there has been tremendous progress in creating synthetic media, mainly thanks to the development of powerful methods based on generative adversarial networks (GAN). Very recently, methods based on diffusion models (DM) have been gaining the spotlight. In addition to providing an impressive level of photorealism, they enable the creation of text-based visual content, opening up new and exciting opportunities in many different application fields, from arts to video games. On the other hand, this property is an additional asset in the hands of malicious users, who can generate and distribute fake media perfectly adapted to their attacks, posing new challenges to the media forensic community. With this work, we seek to understand how difficult it is to distinguish synthetic images generated by diffusion models from pristine ones and whether current state-of-the-art detectors are suitable for the task. To this end, first we expose the forensics traces left by diffusion models, then study how current detectors, developed for GAN-generated images, perform on these new synthetic images, especially in challenging social-networks scenarios involving image compression and resizing. Datasets and code are available at github.com/grip-unina/DMimageDetection.

1. INTRODUCTION

Diffusion models enable highly photorealistic, text- or sketch-guided images across virtually unlimited categories, but that flexibility also supports tailored disinformation. This paper investigates their forensic traces and tests whether existing detectors work, including after compression and resizing.

1. INTRODUCTION

  • Text- and sketch-guided diffusion models can generate photorealistic images across virtually unlimited subjects and contexts, aiding creative users but also enabling tailored disinformation.The paper frames this flexibility as a new threat to assess.Source: §1 · p. 1
  • Prior diffusion-image studies identified shadow, reflection, and lighting inconsistencies [1] [2], while earlier diffusion detection work [14] considered ideal conditions but not robustness.The introduction also notes encouraging results from the StyleGAN3 generalization experiment and the IEEE VIP Cup.Source: §1 · pp. 1–2
  • Generation processes leave invisible, architecture-specific traces that can support detection and source attribution, including spatial fingerprints and spectral peaks from GAN upsampling.These traces differ from those typical of modern digital devices.Source: §1 · pp. 1–2
  • Supervised fake-image detectors struggle to generalize to unseen architectures and lose performance after resizing or compression, which can remove weak forensic traces.New architectures such as StyleGAN3 also aim to minimize traces.Source: §1 · p. 2
  • The study analyzes artifacts in images from recent diffusion generators and evaluates deep learning-based detectors in ideal and compressed, resized conditions.It asks whether diffusion images have hidden artifacts similar to GAN images and how effective current state-of-the-art detectors are on them.Source: §1 · p. 2

2. BACKGROUND

Prior detector research has focused mainly on GAN-generated images and identifies robustness, training diversity, and preservation of forensic traces as key design concerns.

2. BACKGROUND

  • Most prior work on synthetic-image detectors studied GAN-generated images, which had dominated the field.This section reviews findings relevant to developing successful and robust deep learning-based detectors.Source: §2 · p. 2
  • Blurring and compression augmentation are important for robustness; training-set diversity helps generalize to unseen architectures, and later work links augmentation and diversity to detector reliability.Source: §2 · p. 2
  • Avoiding information loss, especially resizing, helps preserve high-frequency forensic traces; strategies include unresized patches, whole-image fusion, and avoiding early downsampling.Resampling and interpolation can erase subtle generation traces.Source: §2 · p. 2
  • Pre-training on large datasets remains important, while residual inputs do not improve performance and extreme augmentation yields only marginal gains.These observations come from an extensive analysis of synthetic-image detector performance.Source: §2 · p. 2

3. ARTIFACT ANALYSIS

The section estimates artificial fingerprints from image noise residuals and finds that their spectral visibility varies across generative architectures.

3. ARTIFACT ANALYSIS

  • Prior work found GAN fingerprints depend on architecture and specific parameters, extracting them from spatial-domain noise residuals in a procedure modeled on PRNU estimation.The fingerprint is estimated by averaging residuals after treating each as a deterministic fingerprint plus random noise.Source: §3 · p. 2
  • Following GAN-fingerprint work, the study averages residuals from 1,000 images using the denoiser in and Fourier-transforms the result for spectral analysis.The residuals are formed by removing an estimate of scene content from each image.Source: §3 · p. 2
  • Strong spectral peaks appear for GANs and GLIDE, Latent Diffusion, and Stable Diffusion [5], but are much weaker for ADM [26] and DALL·E 2 [3].The weaker peaks foreshadow more controversial fingerprint-based forensic results for ADM and DALL·E 2.Source: Figure 2 · p. 3, §3 · p. 3

4. DETECTION PERFORMANCE

The section evaluates whether detectors trained on one generative model generalize to unseen architectures, including under social-media-like resizing and compression. Detection is often more reliable by AUC than by fixed-threshold accuracy, and calibration improves accuracy without solving mismatches in image artifacts.

Generalization and robustness

  • The experiments train detectors on ProGAN or Latent Diffusion and test across GANs, transformers, and diffusion models using AUC and accuracy.They compare Spec, PatchForensics, Wang2020, and Grag2021 on synthetic images from 12 models and real images from COCO, ImageNet, and UCID.Source: §4 · p. 3
  • On uncompressed PNG tests, AUC is almost perfect for seen ProGAN and pretty good for other architectures, but fixed-threshold accuracy is often unsatisfactory.The favorable result is partly explained by real camera images containing JPEG artifacts absent from the synthetic PNGs.Source: §4 · p. 3, Table 1 · p. 4
  • After resizing and JPEG compression, AUC remains acceptable but accuracy is almost random; DALL·E 2 and ADM are the hardest diffusion models.The test images are randomly cropped, resized to 200×200 pixels, and compressed at JPEG quality 65–100 to simulate social-media laundering.Source: §4 · p. 4, Table 1 · p. 4
  • Training on ADM yields almost perfect detection on ADM and Stable Diffusion, but only modest gains on other diffusion models and GAN images.The authors attribute the ADM–Stable Diffusion result to similar artifacts, while Stable and Latent Diffusion have cues different from ADM and DALL·E 2.Source: §4 · p. 4, Table 2 · p. 4

Fusion and calibration

  • Fusing outputs from ProGAN- and Latent Diffusion-trained networks improves GAN detection while retaining reasonable diffusion performance, but fixed-threshold accuracy remains extremely low.Platt scaling, assuming two real and two synthetic images per model, greatly improves accuracy but cannot reliably detect images with artifacts unlike those seen in training.Source: §4 · p. 4, Table 2 · p. 4

5. CONCLUSION

Diffusion-model images show some distinctive forensic fingerprints, but detecting them remains difficult because detector performance varies across models and generalization is the main hurdle.

5. CONCLUSION

  • Generalization remains the main hurdle: detectors trained only on GAN images perform poorly on diffusion-model images.Including a diffusion model in training can help detect images from similar diffusion models, but may still perform unsatisfactorily on others.Source: §5 · p. 4
  • Diffusion-model images are partially confirmed to have distinctive fingerprints, as GAN images do.The fingerprints and forensic cues differ across models, accompanying significant variation in detector performance.Source: §5 · p. 4
  • The authors characterize these findings as preliminary and call for deeper analyses of diffusion-model image detection.Source: §5 · p. 4

Related papers

Loading 2211.00680v1…