Source-linked AI summary
On the detection of synthetic images generated by diffusion models
Riccardo Corvi, Davide Cozzolino, Giada Zingarini, Giovanni Poggi, Koki Nagano, Luisa Verdoliva
TL;DR
Diffusion models make realistic, flexible synthetic images easier to create, raising questions about how reliably they can be detected and whether GAN-trained detectors transfer. The paper analyzes diffusion-model fingerprints and evaluates detectors across clean and social-media-like compressed, resized images, finding partial fingerprint confirmation and substantial generalization difficulties.
Problem
The paper asks whether diffusion-generated images contain detectable hidden artifacts and whether current state-of-the-art detectors remain effective on them.
Method
The authors generate images from multiple GAN, transformer, and diffusion models, analyze their forensic artifacts, and test deep-learning detectors under ideal and compressed, resized conditions.
Results
Detection results vary substantially by generator: diffusion fingerprints are only partially confirmed, GAN-trained detectors generalize poorly, and training on one diffusion model mainly helps with similar models.
Takeaways & Limitations
Generalization remains the main hurdle, so detector performance depends strongly on whether training exposes cues similar to those in the evaluated diffusion models.
Abstract
from arXiv · showhide
Over the past decade, there has been tremendous progress in creating synthetic media, mainly thanks to the development of powerful methods based on generative adversarial networks (GAN). Very recently, methods based on diffusion models (DM) have been gaining the spotlight. In addition to providing an impressive level of photorealism, they enable the creation of text-based visual content, opening up new and exciting opportunities in many different application fields, from arts to video games. On the other hand, this property is an additional asset in the hands of malicious users, who can generate and distribute fake media perfectly adapted to their attacks, posing new challenges to the media forensic community. With this work, we seek to understand how difficult it is to distinguish synthetic images generated by diffusion models from pristine ones and whether current state-of-the-art detectors are suitable for the task. To this end, first we expose the forensics traces left by diffusion models, then study how current detectors, developed for GAN-generated images, perform on these new synthetic images, especially in challenging social-networks scenarios involving image compression and resizing. Datasets and code are available at github.com/grip-unina/DMimageDetection.
† NVIDIA
The paper identifies synthetic image detection and diffusion models as key topics in media forensics.
- The paper focuses on detecting synthetic images generated by GANs and diffusion models.
1. INTRODUCTION
Diffusion models produce highly realistic, flexible synthetic images, creating opportunities for creative work and risks for disinformation. This paper examines their forensic traces and whether existing detectors remain effective, especially after social-media processing.
- Diffusion models generate photorealistic images across virtually unlimited subjects and contexts from textual descriptions or pilot sketches.
- Their flexibility also enables malicious users to create fake media tailored to disinformation goals.
- Current detectors exploit generation traces that can remain invisible to humans and support fake-image detection and source attribution.
- New architectures and social-network processing challenge detectors because supervised models generalize poorly and compression or resizing can remove weak forensic traces.
- The study asks whether diffusion images contain GAN-like hidden artifacts and evaluates detector performance in ideal and compressed, resized conditions.
2. BACKGROUND
Prior work primarily studied GAN-generated images and identified training diversity, augmentation, local analysis, and information-preserving processing as important for robust detection.
- Most prior synthetic-image detection research concerns GAN-generated images because GANs dominated the field.
- Blurring and compression augmentation are widely regarded as important for detector robustness.
- Training-set diversity helps detectors generalize to architectures unseen during training, especially when combined with augmentation.
- Local patches and joint analysis of local and global features are reported as useful detection strategies.
- Avoiding resizing and other information losses preserves high-frequency traces that may be erased by resampling and interpolation.
3. ARTIFACT ANALYSIS
The study estimates artificial fingerprints from image residuals and analyzes their Fourier spectra across GAN, VQ-GAN, and diffusion architectures. Strong spectral peaks occur for some diffusion models but are much weaker for ADM and DALL·E 2.
- GAN fingerprints depend on architecture and parameters and can be estimated by subtracting a denoised scene from each image to obtain noise residuals.
- The analysis averages residuals from 1000 images and applies a Fourier transform to examine their spectra.
- Figure 2 compares Fourier-amplitude spectra for ProGAN, BigGAN, StyleGAN2, Taming Transformers, DALL·E Mini, and diffusion models.
- Strong spectral peaks appear for GANs and for GLIDE, Latent Diffusion, and Stable Diffusion, indicating quasi-periodical fingerprint patterns.
- ADM and DALL·E 2 show much weaker peaks, predicting more controversial fingerprint-based detection results.
4. DETECTION PERFORMANCE
The experiments evaluate detector generalization from ProGAN or Latent Diffusion training to multiple generative architectures, including under social-media-like resizing and compression. Performance varies substantially across models, with calibration improving accuracy but not resolving artifacts unseen during training.
- Experimental setup: The study evaluates GANs, transformers, and diffusion models using detectors trained on either ProGAN or Latent Diffusion images.Tests use 1000 synthetic images per model and 5000 real images.
- Uncompressed images: On uncompressed PNG images, AUC is almost perfect for ProGAN and remains strong across several unseen architectures, but accuracy is often unsatisfactory.The training threshold does not transfer well to images from different origins.
- Social-media conditions: Resizing and JPEG compression generally reduce detection performance, while accuracy remains almost random despite acceptable AUC values.The procedure crops images, resizes them to 200×200 pixels, and applies JPEG quality factors from 65 to 100.
- Diffusion-model generalization: DALL·E 2 and ADM are the most difficult diffusion models to detect after laundering because their forensic artifacts are weak.These models had also shown weak artifacts in the preceding fingerprint analysis.
- Diffusion-model generalization: Training Grag2021 on ADM enables almost perfect detection of ADM and Stable Diffusion, but performs only modestly on other diffusion models.The result is consistent with similar artifacts in ADM and Stable Diffusion, while Stable and Latent Diffusion use different cues from ADM and DALL·E 2.
- Fusion and calibration: Output fusion improves GAN detection, while Platt calibration greatly improves accuracy but remains unreliable for artifacts substantially different from training examples.Fusion averages outputs from networks trained on ProGAN and Latent Diffusion; calibration assumes two real and two synthetic images per model.
5. CONCLUSION
The study finds partial evidence that diffusion-model images contain distinctive forensic fingerprints, but detector performance varies strongly across architectures. Generalization remains the main difficulty, and the results are preliminary.
- Findings: Diffusion images show distinctive fingerprints only partially analogous to those found in GAN images.The experiments also reveal that forensic cues differ substantially between diffusion architectures.
- Findings: Detectors trained only on GAN images perform poorly on diffusion-generated images, while including a diffusion model helps mainly for similar architectures.Performance remains unsatisfactory for diffusion models with different cues.
- Scope: The reported results are preliminary, and deeper analyses are needed to address diffusion-model image detection.