Source-linked AI summary
Raising the Bar of AI-generated Image Detection with CLIP
Davide Cozzolino, Giovanni Poggi, Riccardo Corvi, Matthias Nießner, Luisa Verdoliva
TL;DR
AI-generated images demand detectors that generalize across unseen generators and remain reliable after common post-processing. This work builds a lightweight CLIP-feature detector from paired examples and finds strong generalization and robustness with little training data.
Problem
Detectors must handle unseen generation methods and post-processing that attenuates forensic traces in realistic data.
Method
The detector uses CLIP ViT L/14 image features from paired real and synthetic images to train a linear SVM.
Results
+6.8% average AUC over the best competitor, while CLIP-based detectors retain good performance on post-processed data.
Takeaways & Limitations
A small set of paired examples from one generator can support strong performance across many generators and challenging conditions.
Takeaways & Limitations
The study leaves future work on few-shot adaptation and interpretability of the forensic features used by the detector.
Abstract
from arXiv · showhide
The aim of this work is to explore the potential of pre-trained vision-language models (VLMs) for universal detection of AI-generated images. We develop a lightweight detection strategy based on CLIP features and study its performance in a wide variety of challenging scenarios. We find that, contrary to previous beliefs, it is neither necessary nor convenient to use a large domain-specific dataset for training. On the contrary, by using only a handful of example images from a single generative model, a CLIP-based detector exhibits surprising generalization ability and high robustness across different architectures, including recent commercial tools such as Dalle-3, Midjourney v5, and Firefly. We match the state-of-the-art (SoTA) on in-distribution data and significantly improve upon it in terms of generalization to out-of-distribution data (+6% AUC) and robustness to impaired/laundered data (+13%). Our project is available at https://grip-unina.github.io/ClipBased-SyntheticImageDetection/
1. Introduction
AI-generated images are increasingly accessible, creating urgent demand for authenticity tools that generalize beyond known generators and survive post-processing. This work investigates CLIP-based detection using very limited paired examples and reports strong cross-generator performance.
- Accessible generative tools expand both creative opportunities and disinformation risks, increasing demand for automatic media-authentication tools.
- Detectors must generalize to unseen architectures and generation methods because real-world test images rarely match training distributions.
- Compression and resizing can wash out subtle forensic traces, making robustness to post-processing essential.
- Prior evidence indicates training diversity helps generalization, but GAN-trained detectors perform less reliably on diffusion-generated images.
- CLIP-based methods are explored as few-shot-capable alternatives for synthetic-image detection and out-of-distribution evaluation.
- The proposed detector uses paired real/fake examples from one generator, with top performance from 1,000 to 10,000 pairs and minor decay at 100 or 10.
2. Related work
Related work develops synthetic-image detectors around visible errors and invisible forensic traces, but cross-family generalization and post-processing robustness remain difficult. Recent multimodal approaches use CLIP, motivating a lower-data strategy.
- Synthetic-image detection research covers GANs and diffusion models, increasingly emphasizing invisible spatial or frequency-domain traces over visible artifacts.
- Spatial domain methods: Spatial methods exploit model-specific digital fingerprints estimated from generated images, often using noise residuals.
- Spatial domain methods: Generalization can be pursued through augmentation, diverse categories, ensembling, local patches, and combined global-local features.
- Detectors designed for GAN images struggle on diffusion images, especially after compression or resizing, and may require calibration data from the tested model.
- Frequency domain methods: Frequency-domain artifacts can arise from generator up-sampling, producing regular spatial patterns and Fourier-domain peaks.
- Methods based on multimodal features: Only a few studies use multimodal features for forensic detection, and prior CLIP-based OOD work relies on large fake-and-real training datasets.
3. Datasets and metrics
The evaluation uses a large, bias-mitigated dataset spanning GAN, diffusion, and commercial generators, with realistic post-processing. Performance is measured using threshold-independent AUC and AP plus thresholded accuracy.
- The study evaluates detector behavior on unseen data from different origins and under post-processing, using a large test dataset designed to mitigate validation biases.
- Test generators span GAN-based, diffusion-based, and commercial families, including DALL·E 2, DALL·E 3, Midjourney v5, and Adobe Firefly.
- Real-image counterparts are selected carefully to avoid foreseeable biases in detection experiments.
- Pristine and synthetic images with similar semantic content are constructed using textual descriptions extracted from a real dataset and prompts for generation.
- The dataset contains 32,000 real and fake images and simulates social-network sharing through cropping, resizing, and JPEG compression.
- AUC and AP are threshold-independent, whereas accuracy uses a fixed 0.5 threshold to simulate evaluation without calibration information.
4. CLIP for synthetic image detection
The detector pairs real images with synthetic counterparts sharing captions, extracts CLIP image features, and trains a linear SVM. Performance remains strong with small reference sets, while image quality, augmentation, and CLIP pre-training substantially affect results.
- Detector design: The detector generates synthetic counterparts from captions of N real images, extracts next-to-last-layer CLIP features, and trains a linear SVM on the paired vectors.Real/fake pairing is intended to reduce semantic bias, especially when N is very small.
- Reference set size: AUC and AP exceed 85% across known GAN and diffusion families with only 10+10 reference images, while commercial-tool performance is substantially worse.Increasing the reference set improves performance by 5–10% up to the 10k plateau.
- Reference set size: Accuracy does not always increase with N because its fixed 0.5 threshold differs from the optimal threshold for many out-of-distribution generators.AUC and AP are threshold-independent, whereas accuracy depends critically on threshold calibration.
- Reference set size: With compression or resizing, AUC reaches 75–90% and accuracy 65–80% at N=10k; performance is nearly optimal at N=100, but 10+10 images are inadvisable.These results concern post-processed images simulating realistic conditions.
- Reference set content: Reference-set performance depends on both image quantity and quality, including the specific real/fake combination and whether resizing or compression augmentation is used.These effects remain visible even with 10,000+10,000 reference images.
5. Comparison with the state-of-the-art
Across 18 generative models and post-processed images, existing detectors often fail outside their generator family, whereas the CLIP-based detector maintains strong and stable performance. It exceeds the best competitor by 6.8% average AUC and remains effective under perturbations.
- Generalization analysis: Across 18 generative models, no state-of-the-art method performs uniformly well, while the CLIP-based detector consistently delivers strong out-of-distribution performance.Methods trained on GANs generally transfer within GANs but perform worse on diffusion models, with the reverse pattern for diffusion-trained methods.
- Robustness to perturbations: On post-processed images, most state-of-the-art methods approach random-chance performance, whereas CLIP-based detectors retain good performance.Compression and resizing attenuate forensic traces, particularly for unknown commercial models.
6. Beyond low-level forensic traces
The CLIP-based detector remains effective when low-level forensic traces are removed or manipulated, indicating complementary information relative to conventional detectors. Its fusion with a low-level detector further improves performance, although gains are smaller after resizing and compression.
- Conventional detectors degrade when resizing or compression reduces subtle forensic traces, whereas the CLIP-based detector continues working well under these conditions.This behavior suggests reliance on higher-level semantic features rather than only low-level artifacts.
- Table 4 compares four proposed variants using 1k or 10k real and fake training images, with optional compression/resizing augmentation, and reports dataset-average AUC.Table 5 reports AUC after random cropping, resizing, and compression.
- After attacks removing traces from synthetic images or adding them to real images, the proposed method suffers only a very limited loss while Corvi et al. degrades dramatically.The attacks were evaluated on 1,000 real and 1,000 synthetic images using AUC.
- The CLIP-based and Corvi detector scores are almost orthogonal, suggesting that they depend on uncorrelated features suitable for fusion.The proposed decision rule declares an image real only when both detectors agree.
- The fusion improves over the proposed CLIP-based detector by +3.6% AUC and +7.4% Accuracy across GAN, Diffusion, and Commercial Tools.A smaller improvement is observed on resized or compressed images because low-level traces are more compromised.
- A suitable 4× decimation removes Fourier peaks in a Stable Diffusion XL synthetic image, while autoencoder processing creates new peaks in a real image.The spectra illustrate how low-level traces can be removed from synthetic images or introduced into real images.
7. Discussion
The discussion concludes that CLIP features generalize across generators and conditions while remaining largely independent of low-level forensic traces. It identifies future work in adaptive few-shot methods and interpretability.
- A simple CLIP-based detector achieves top performance across many generators and challenging conditions using only a few examples, including examples from generators not under test.Maximizing reference-feature diversity also improves performance.
- Further enlarging CLIP’s pre-training set continues boosting performance, by up to 10%.
- Fusion with traditional detectors is identified as a route to further performance improvements because CLIP features are largely independent of low-level forensic traces.
- Table 6 shows that Corvi et al., which relies on low-level forensic traces, is severely affected by attacks, while the proposed method keeps working well across conditions.
- Future work includes few-shot adaptation to the situation of interest and interpreting which forensic features drive detector decisions.
Supplemental Material
The supplemental material expands the methodological comparisons, ablations, robustness analysis, social-network experiments, and generalization evaluation described in the main paper.
- The appendix reports comparison methods, additional ablations and results, robustness analyses, social-network few-shot experiments, and experiments with additional synthetic generators.
A. Reference methods
The supplemental reference section describes conventional and recent synthetic-image detectors, their training data or forensic representations, and the evaluation settings used for comparison.
- Wang et al. introduced a ResNet50 CNN detector and the LSUN/ProGAN dataset later adopted for model training.
- Several reference methods use specialized representations, including preserved low-level traces, local patches, learned noise patterns, or gradients from pretrained CNNs.
- Corvi et al. uses strong augmentation and a large latent-diffusion dataset to improve robustness and generalization.
- DIRE trains ResNet-50 classifiers on ADM or StyleGAN images, based on the premise that synthetic images reconstruct better through a pretrained model.
- NPR uses residual images formed from differences between an original image and its interpolated version, with a ResNet-50 trained on four ProGAN classes.
- The proposed detector extracts next-to-last-layer CLIP ViT-L/14 features and trains an SVM on a limited reference-feature set, with alternative layers and classifiers evaluated.
- Additional experiments report AUC and balanced accuracy by generator family, including post-processed images where many methods perform near chance.
D. Additional robustness analysis
The analysis evaluates detector robustness across compression and resizing conditions on images from six generation models. CLIP-based detectors remain effective under these impairments, outperforming reference methods in difficult conditions.
- Web examples: Figure 9 illustrates real and synthetic images from DALL·E 3, Firefly, and Midjourney downloaded from X.The examples are arranged from left to right as real, DALL·E 3, Firefly, and Midjourney images.
- Robustness protocol: JPEG quality, resizing scale, and WebP compression are varied across SynthBuster images generated by six models.The evaluation reports AUC for competitive reference methods and proposed CLIP-based detectors.
- Robustness findings: CLIP-based detectors with augmentation are basically insensitive to JPEG, WebP compression, and resizing.The 1k+ and 10k+ variants maintain robustness across all tested impairment conditions.
- Robustness findings: Reference methods show substantially larger degradation under compression and resizing, with Ojha becoming useless at 25% rescaling.Ojha loses up to 10 points under compression, while Corvi is unaffected by JPEG but loses performance under strong WebP compression and resizing.
E. Few-shot analysis in the wild
The few-shot experiment tests whether the detector can adapt to realistic web data using only a small number of labeled examples. Using 10 real and 10 generated images from a target model provides an impressive boost over a larger but misaligned training set.
- Dataset: The experiment uses 500 real and 1,500 synthetic images from X, spanning DALL·E 3, Midjourney, and Firefly.Generator identities were inferred from tags and annotations on the social network.
- Few-shot protocol: The few-shot setting uses 10 real and 10 generated examples from one model, testing on all remaining images over 1,000 runs.Results are reported using AUC and accuracy.
- Few-shot results: 10+10 aligned examples provide an impressive performance boost over a much larger training set whose real and synthetic data are not aligned with the test data.The comparison uses COCO real images and latent-diffusion synthetic images for the larger training set.
- Comparison: Fusion of low-level and high-level features achieves more than 90% average AUC in the realistic web scenario.All methods degrade on this data, while the fusion approach remains comparable to the few-shot setting with prior information.
F. Further generalization results
Further tests add eight generators and 8,000 synthetic images to assess generalization beyond the original data. The CLIP-based detector performs consistently across generators and retains an advantage under post-processing.
- Extended evaluation: The extended test set adds eight generators and 8,000 synthetic images for generalization analysis.Results are reported in terms of AUC and accuracy for four CLIP-based detector variants and SoTA methods.
- Generalization results: The proposed method delivers consistently good AUC and accuracy across the additional generators, whereas SoTA performance varies substantially.Reference methods perform very well on some generators and very poorly on others.
- Generalization results: 8.5% AUC and 13% Accuracy are the average gains over the best reference method on the additional data.The reported comparison aggregates performance across the extended generator set.
- Post-processing robustness: Post-processing causes dramatic losses for most competitors, sometimes reducing them to random-guess performance, while the proposed method preserves good performance.The strongest proposed variant includes augmentation in the reference data.