Forgery-aware Adaptive Transformer for Generalizable Synthetic Image Detection

Huan Liu; Zichang Tan; Chuangchuang Tan; Yunchao Wei; Yao Zhao; Jingdong Wang

Source-linked AI summary

Forgery-aware Adaptive Transformer for Generalizable Synthetic Image Detection

Huan Liu, Zichang Tan, Chuangchuang Tan, Yunchao Wei, Yao Zhao, Jingdong Wang

arXiv:2312.16649v1Dec 27, 2023cs.CV

TL;DR

Generalizable synthetic image detection remains difficult across diverse GANs and diffusion models because fixed pre-trained paradigms may learn insufficient forgery representations. FatFormer adapts CLIP with a forgery-aware adapter and language-guided alignment, achieving strong results on unseen GANs and diffusion images. The authors note remaining room for improvement on some diffusion models.

Problem
Synthetic image detectors often degrade on unseen GAN- and diffusion-generated images, while frozen pre-trained paradigms may provide insufficiently learned forgery representations.
Method
FatFormer adapts CLIP using image- and frequency-domain forgery-aware adapters together with language-guided contrastive alignment between image features and text prompts.
Results
FatFormer achieves 98.4% ACC and 99.7% AP on 8 GAN types, and 95.0% ACC and 98.8% AP on 10 unseen diffusion types using limited ProGAN training data.
Takeaways & Limitations
Forgery adaptation improves the generalizability of synthetic image detection beyond the fixed pre-trained paradigm.
Takeaways & Limitations
FatFormer still has room to improve on diffusion models such as Guided, and stronger detectors require clarifying distinctions between diffusion- and GAN-generated images.

Abstract

from arXiv · show

In this paper, we study the problem of generalizable synthetic image detection, aiming to detect forgery images from diverse generative methods, e.g., GANs and diffusion models. Cutting-edge solutions start to explore the benefits of pre-trained models, and mainly follow the fixed paradigm of solely training an attached classifier, e.g., combining frozen CLIP-ViT with a learnable linear layer in UniFD. However, our analysis shows that such a fixed paradigm is prone to yield detectors with insufficient learning regarding forgery representations. We attribute the key challenge to the lack of forgery adaptation, and present a novel forgery-aware adaptive transformer approach, namely FatFormer. Based on the pre-trained vision-language spaces of CLIP, FatFormer introduces two core designs for the adaption to build generalized forgery representations. First, motivated by the fact that both image and frequency analysis are essential for synthetic image detection, we develop a forgery-aware adapter to adapt image features to discern and integrate local forgery traces within image and frequency domains. Second, we find that considering the contrastive objectives between adapted image features and text prompt embeddings, a previously overlooked aspect, results in a nontrivial generalization improvement. Accordingly, we introduce language-guided alignment to supervise the forgery adaptation with image and text prompts in FatFormer. Experiments show that, by coupling these two designs, our approach tuned on 4-class ProGAN data attains a remarkable detection performance, achieving an average of 98% accuracy to unseen GANs, and surprisingly generalizes to unseen diffusion models with 95% accuracy.

1. Introduction

Synthetic image detection must generalize across GANs and diffusion models, but frozen pre-trained paradigms can learn insufficient forgery representations. FatFormer adapts CLIP features through image- and frequency-domain forgery extraction and language-guided contrastive alignment.

Motivation: Synthetic image detectors face performance degradation on unseen GAN- and diffusion-generated images, motivating generalizable detection.The paper identifies potential abuse and privacy threats from hyper-realistic synthetic images.
Motivation: Frozen CLIP-based paradigms preserve generalizability but limit pre-trained models’ ability to learn pertinent forgery features.UniFD freezes CLIP-ViT and trains only an attached linear classifier.
Motivation: Logit distributions show substantial real–fake overlap for unseen GANs and diffusion models under the fixed paradigm.The paper also reports increasingly indistinct separation even for ProGAN testing samples.
Method: FatFormer introduces a forgery-aware adaptive transformer based on CLIP’s pre-trained vision-language spaces.Its goal is to obtain well-generalized forgery representations with a distinct real–fake boundary.
Method: The forgery-aware adapter integrates local traces from image and frequency domains using convolutional image extraction and grouped attention over DWT bands.The adapter targets artifacts such as blur textures, color mismatch, and frequency clues.
Method: Language-guided alignment supervises forgery adaptation through contrastive objectives between adapted image features and text prompt embeddings.The approach draws on CLIP-style image–text similarity supervision rather than relying only on binary cross-entropy over image features.
Results: 98.4% ACC and 99.7% AP are achieved on 8 GAN types, while 95.0% ACC and 98.8% AP are achieved on 10 unseen diffusion types using limited ProGAN data.These results are reported for FatFormer under the paper’s stated training and evaluation settings.

2. Related Work

Synthetic image detection research includes image-based, frequency-based, and pre-trained-based methods. Related pre-trained approaches freeze CLIP-ViT for feature extraction and train a linear classifier, whereas FatFormer emphasizes adapting pre-trained representations.

Synthetic image detection: Synthetic image detection methods are broadly grouped into image-based, frequency-based, and pre-trained-based approaches.Prior work also uses GAN fingerprints, data augmentation, and large-scale GAN images to improve detection of unseen data.
Pre-trained methods: Frozen CLIP-ViT can extract forgery features for a linear classifier when deep networks fail on fake images from new breeds.This describes the pre-trained-based strategy associated with UniFD.
Pre-trained methods: FatFormer differs from UniFD by treating forgery adaptation of pre-trained models as essential to synthetic image detection generalizability.The paper frames this as a distinct motivation from adopting frozen representations without learning.

3. FatFormer

FatFormer adapts CLIP’s image and text representations for forgery detection through forgery-aware feature extraction and language-guided alignment. Its framework combines image–text similarities with patch-level forgery representations to guide classification.

3. FatFormer: FatFormer uses pretrained image and text encoders, a forgery-aware adapter, and language-guided alignment to predict forgery probability.The probability is computed from the softmax of cosine similarities between image features and text prompt embeddings.
3.2. Forgery-aware adapter (FAA): Forgery-aware adapters bridge adjacent ViT stages and integrate local forgery traces from image and frequency domains.They provide a comprehensive local viewpoint of image features for forgery adaptation.
3.2. Forgery-aware adapter (FAA): The image forgery extractor uses convolutional layers and ReLU to capture low-level artifacts, while the frequency extractor mines traces across DWT frequency bands.DWT retains spatial structure while decomposing inputs into four frequency bands; inverse DWT returns frequency features to the image domain.
3.2. Forgery-aware adapter (FAA): A learnable scale factor λ controls information from the image and frequency domains before adapted features enter the next ViT stage.The scale factor avoids introducing additional hyper-parameters.
3.3. Language-guided alignment (LGA): Language-guided alignment enriches text prompts with image-patch context and aligns local patch tokens with global text prompt embeddings.Its patch-based enhancer constructs contextual prompts, while its text-guided interactor adaptively augments text representations.
3.3. Language-guided alignment (LGA): The augmented contrastive objective combines vanilla CLIP cosine similarity with similarity between text prompts and aligned image patch tokens.Cross-entropy over the resulting augmented probability supervises the forgery adaptation.

4. Experiments

FatFormer is evaluated under limited ProGAN supervision against unseen GANs and diffusion models, with ablations examining its forgery-aware adapter and language-guided alignment. It consistently improves detection performance and focuses attention on localized forgery traces.

Main results: 98.4% ACC and 99.7% AP are achieved on 8 GAN types, surpassing UniFD by 9.3% ACC and 1.4% AP under 4-class supervision.The comparison uses the same pre-trained CLIP model and limited ProGAN training data.
Main results: 95.0% ACC and 98.8% AP are achieved on 10 types of unseen diffusion images after training on 4-class ProGAN data.The diffusion test setting uses generative processes different from GANs.
Ablation study: Removing either image or frequency processing from the forgery-aware adapter causes severe degradation, with frequency removal producing over a 3.0% ACC gap.The ablation evaluates mean accuracy and average precision on the GANs dataset.
Ablation study: Augmented contrastive supervision improves generalizability by 2.0% ACC over vanilla contrastive supervision, while language-guided alignment alone reaches 91.5% ACC.The study compares image-only probing, vanilla image-text contrastive objectives, and augmented contrastive objectives.
Ablation study: Language-guided alignment concentrates attention on semantic foreground patches in fake images while producing almost no response for real images.The salient regions are visualized using gradient norms, with brighter colors indicating stronger responses.
Architecture analysis: FatFormer's forgery adaptation strategy transfers across four alternative architectures evaluated with different multi-modal structures and pre-training strategies.The analysis reports ACCM and APM scores for the architectures in Table 4.

5. Conclusion

FatFormer uses forgery-aware adaptation with two core designs to improve generalizable synthetic image detection. The approach outperforms the fixed pre-trained paradigm and remains flexible across architectures and pre-training strategies.

FatFormer introduces a forgery-aware adapter and language-guided alignment for adapting pre-trained models to synthetic image detection.
FatFormer outperforms the previous fixed pre-trained paradigm by a large margin.
The forgery adaptation can be applied across various pre-trained architectures and different pre-training strategies.
Limitations and future works: FatFormer generalizes well on most generative methods but still has room for improvement on diffusion models such as Guided.

A. Appendix

The appendix covers potential societal impacts, ablations of FatFormer’s hyperparameters, and robustness against image perturbations.

The appendix discusses potential negative societal impacts arising in practical scenarios.
It presents ablation studies examining the influence of hyperparameters used within FatFormer.
It analyzes whether forgery adaptation enhances robustness against image perturbations.

A.1. Broader impacts

Synthetic image detection tools may create content-moderation risks by flagging legitimate images that resemble forgeries. The paper calls for further research before practical deployment in content moderation.

Legitimate content resembling forgeries may be mistakenly flagged, affecting normal information sharing.
These consequences require further research and consideration when deploying synthetic image detection for content moderation.

A.2. More Ablations

The ablations select default settings for context embeddings, forgery-aware adapters, and convolutional kernel size. The reported choices favor eight embeddings, three adapters, and 1 × 1 kernels.

Number of auto context embeddings: Eight auto context embeddings achieve better results than 16 embeddings and are selected by default.
Number of forgery-aware adapters: Three forgery-aware adapters achieve good performance and are selected as FatFormer’s default.
Kernel size of image forgery extractor: A 1 × 1 kernel yields superior results for constructing the image forgery extractor.The paper conjectures that larger kernels may disturb ViT modeling by fusing adjacent patch tokens without useful low-level similarity.

A.3. Robustness on image perturbation

FatFormer is evaluated for robustness under common image perturbations on the GANs dataset, including a combined four-perturbation setting. It outperforms fixed-paradigm baselines, with a margin exceeding 12.0% under Gaussian blurring and gains across all tested GAN methods.

Perturbation setup: Robustness is tested on GANs images using random cropping, Gaussian blurring, JPEG compression, and Gaussian noising, each applied with 50% probability.FatFormer is compared with UniFD and LGrad, both described as using the fixed pre-trained paradigm.
Individual perturbations: +12.0% is the margin by which FatFormer exceeds UniFD under Gaussian blurring.The passage attributes this improvement mainly to FatFormer’s forgery adaptation and generalized forgery representations.
Combined perturbations: Under combined random cropping, Gaussian blurring, JPEG compression, and Gaussian noising, FatFormer beats UniFD on all testing GAN methods.The combined-perturbation results are presented in Figure 5 as evidence of improved robustness from forgery adaptation.