PaperlayerView exact revision on arXiv

Source-linked AI summary

AEROBLADE: Training-Free Detection of Latent Diffusion Images Using Autoencoder Reconstruction Error

Jonas Ricker, Denis Lukovnikov, Asja Fischer

arXiv:2401.17879v2cs.CV

TL;DR

Visual disinformation motivates better forensic detection for latent diffusion models, whose high-resolution synthesis is widespread but insufficiently studied. AEROBLADE measures autoencoder reconstruction error to distinguish generated from real images, achieving strong detection performance without training and supporting inpainting-region identification. Its best performance requires access to the generating model’s autoencoder, although related autoencoders can sometimes detect images from other models.

  • Problem

    The forensic analysis of latent diffusion models remains insufficient despite their role in accessible, high-resolution synthetic-image generation and the resulting erosion of trust in legitimate sources.

  • Method

    AEROBLADE detects latent-diffusion images by measuring the distance between an image and its reconstruction through the model’s autoencoder, typically using LPIPS.

  • Results

    AEROBLADE reaches 0.992 mean average precision across state-of-the-art models and performs comparably to trained deep classifiers without training.

  • Takeaways & Limitations

    Reconstruction errors support training-free detection across multiple latent diffusion models and qualitative identification of inpainted regions.

  • Takeaways & Limitations

    Best results require access to the autoencoder used by the model that generated the image, although Stable Diffusion’s autoencoder can detect Midjourney images almost perfectly.

Abstract

from arXiv · show

With recent text-to-image models, anyone can generate deceptively realistic images with arbitrary contents, fueling the growing threat of visual disinformation. A key enabler for generating high-resolution images with low computational cost has been the development of latent diffusion models (LDMs). In contrast to conventional diffusion models, LDMs perform the denoising process in the low-dimensional latent space of a pre-trained autoencoder (AE) instead of the high-dimensional image space. Despite their relevance, the forensic analysis of LDMs is still in its infancy. In this work we propose AEROBLADE, a novel detection method which exploits an inherent component of LDMs: the AE used to transform images between image and latent space. We find that generated images can be more accurately reconstructed by the AE than real images, allowing for a simple detection approach based on the reconstruction error. Most importantly, our method is easy to implement and does not require any training, yet nearly matches the performance of detectors that rely on extensive training. We empirically demonstrate that AEROBLADE is effective against state-of-the-art LDMs, including Stable Diffusion and Midjourney. Beyond detection, our approach allows for the qualitative analysis of images, which can be leveraged for identifying inpainted regions. We release our code and data at https://github.com/jonasricker/aeroblade .

1. Introduction

The spread of realistic, low-cost text-to-image generation increases visual-disinformation risks and motivates efficient forensic detection of latent diffusion models. AEROBLADE uses autoencoder reconstruction error to detect generated images, achieving strong performance without training and supporting inpainting analysis.

  • High-quality text-to-image models make arbitrary, realistic scenes accessible with few keystrokes, while synthetic media can erode trust in legitimate sources.
  • Latent diffusion models enable high-resolution synthesis efficiently by denoising in an autoencoder’s low-resolution latent space before decoding to images.
  • AEROBLADE detects generated images using their autoencoder reconstruction error, exploiting more accurate reconstruction of generated than real images.
  • 0.992 mean average precision is achieved across state-of-the-art models including Stable Diffusion, Kandinsky, and Midjourney without training.
  • AEROBLADE also uses reconstruction-error information to help identify inpainted regions within real images.

2. Related Work

Prior synthetic-image detectors use visual artifacts, frequency cues, or learned features, but diffusion-model forensics remains less developed than GAN detection. Existing diffusion-focused methods face generalization or training-related limitations, while reconstruction differences provide a related detection direction.

  • Synthetic-image detection has used visual artifacts such as lighting errors, inconsistent reflections, irregular pupils, and frequency-domain signals.
  • Most existing detectors were trained and evaluated on GAN images, leaving forensic analysis of diffusion models comparatively early-stage.
  • A classifier trained on images from an original latent diffusion model showed limited generalization capabilities.
  • DIRE detects images using differences between originals and reconstructions, but relies on a deep classifier rather than a training-free reconstruction-error rule.
  • Reconstruction-based anomaly detection identifies anomalous regions by comparing images with reconstructions from models learned or conditioned on nominal data.

3. Preliminaries

Latent diffusion models generate images by denoising in latent space and use a pretrained autoencoder to map between images and latent representations. LPIPS measures perceptual distance between images through classifier activations.

  • Latent Diffusion Models (LDMs): During diffusion, images are progressively noised and then denoised from Gaussian noise to produce clean images.
  • Latent Diffusion Models (LDMs): An LDM’s encoder maps an image x to latent representation z, while its decoder maps denoised latents back to image x̃.
  • Learned Perceptual Image Patch Similarity (LPIPS): LPIPS estimates perceptual similarity using internal activations of ImageNet-trained classifiers, which correspond well with human perception.
  • Learned Perceptual Image Patch Similarity (LPIPS): LPIPS computes layerwise activation differences after channel scaling and spatial averaging, then sums the resulting similarities.
  • In this paper, “LDM” denotes diffusion models that perform denoising in latent space rather than specifically the model proposed by Rombach et al.

4. Methodology

AEROBLADE applies reconstruction-based detection to latent diffusion autoencoders: generated images are expected to reconstruct more accurately than real images. It measures the distance between an image and its encoder-decoder reconstruction, typically using LPIPS, and classifies by reconstruction error.

  • Reconstruction-based Fake Image Detection: Reconstruction-based detection assumes images generated by a model reconstruct more closely through that model than real images do.
  • AEROBLADE: AEROBLADE uses an LDM’s autoencoder because generated images lie on its constrained latent manifold, whereas real images may be mapped to a nearby point with higher error.
  • AEROBLADE: AEROBLADE enables threshold-based detection without costly deterministic denoising or additional training.
  • AEROBLADE: The reconstruction error is the distance d(x, D_i(E_i(x))) between an image and its encoder-decoder reconstruction.
  • AEROBLADE: LPIPS is suitable for measuring reconstruction error, while alternative distance metrics are also investigated.

5. Experiments

AEROBLADE is evaluated on images from seven text-to-image LDMs using multiple autoencoders and reconstruction-error configurations. Experiments assess detection performance, baseline comparisons, image-complexity effects, and localization of inpainted regions.

  • Setup: The evaluation covers seven text-to-image LDMs, including three Stable Diffusion versions, Kandinsky 2.1, and proprietary models.The study uses 1,000 images per generative model plus 1,000 real images.
  • Detection performance: Generated images consistently have lower minimum reconstruction error than real images across the evaluated datasets.The minimum error is computed across three autoencoders using LPIPS variants.
  • Detection performance: LPIPS2 captures the most meaningful differences, while average precision decreases for higher LPIPS layers with larger receptive fields.The authors associate this decrease with fine-grained details producing higher reconstruction errors.
  • Detection performance: Matching an autoencoder to the dataset yields AP values from 0.991 to 0.999 with LPIPS2, while accurate detection remains possible without Midjourney’s autoencoder.Across datasets, using a nonmatching autoencoder causes only a small performance drop.
  • Comparison to baselines: Correct autoencoder selection can also support model attribution, but attribution is limited when different generators share the same autoencoder.Stable Diffusion 1.1 and 1.5 are given as an example of models using the same autoencoder.
  • Comparison to baselines: AEROBLADE reliably detects generated images from all evaluated models and nearly matches a deep classifier trained on generated images without training.The comparison reports both AP and TPR at a fixed 5% false-positive rate.
  • Qualitative image analysis: For generated images, the relationship between reconstruction error and patch complexity is less pronounced, so highly complex patches can remain accurately reconstructed.The analysis uses overlapping 128 × 128 patches and JPEG-compressed file size as a complexity estimate.
  • Qualitative image analysis: Reconstruction-error maps provide hints for identifying inpainted regions in authentic images.The demonstration uses real images inpainted with Stable Diffusion 1.5 and heatmaps computed with the Stable Diffusion 1 autoencoder.

6. Discussion and Conclusion

AEROBLADE addresses the limited forensic analysis of latent diffusion models with a training-free detector that is comparable to trained deep classifiers. The method also supports model disclosure and qualitative analysis, while requiring access to a suitable autoencoder for best results.

  • AEROBLADE reliably detects images from state-of-the-art LDMs, including Stable Diffusion and Midjourney, despite requiring no training.Its detection performance is comparable to deep classifiers trained directly on LDM-generated images.
  • The method’s main limitation is that best results require access to the autoencoder used by the generating LDM.The authors argue that a sufficiently large pool of autoencoders can cover many practically relevant models.
  • Publishing a custom autoencoder can support responsible disclosure while keeping the latent-space backbone private.The authors describe this as requiring little to no additional overhead.
  • AEROBLADE and follow-up work may help mitigate threats posed by modern text-to-image models to digital society.

7. Implementation Details

The experiments use curated real images and generated images from several latent diffusion models, alongside established detector implementations and a reimplementation where code was unavailable. Image sizes, preprocessing, and generation settings vary by dataset and method.

  • Datasets: Real images come from LAION-Aesthetics2, using images with aesthetics scores of at least 6.5 and smaller sides of at least 512 pixels.
  • Datasets: Stable Diffusion and Kandinsky images are generated with Diffusers defaults at 512 × 512 resolution, and the same library computes autoencoder reconstructions.
  • Datasets: Midjourney samples are drawn from a Kaggle dataset, filtered to versions v4, v5, and v5.1 at 1024 × 1024 resolution.
  • Baselines: Baseline detectors from Gragnaniello, Corvi, Ojha, and DIRE are evaluated using code and checkpoints from their official repositories.
  • Baselines: SeDIDStat is reimplemented from the authors’ definitions because no public code was available, with 50 total steps and TSE = 25 producing the best observed results.

8. Additional Results

Additional analyses examine LPIPS variants, autoencoder attribution, reconstruction error versus complexity, inpainting localization, perturbations, and detector performance across datasets. LPIPS2 often separates real and generated images well, while higher layers can help under perturbations.

  • 8.1. Reconstruction Error Histograms: LPIPS2 produces the most separated reconstruction-error distributions and achieves the highest APs among the evaluated LPIPS variants.Higher-layer variants make the distributions less separable in the unperturbed analysis.
  • 8.2. Attribution Based on Minimal Reconstruction Error: Almost all samples are attributed to the autoencoder that generated them using minimal reconstruction error, while Midjourney results indicate similarity to Stable Diffusion 2’s autoencoder.
  • 8.3. Reconstruction Error Against Complexity: The relationship between image complexity and reconstruction error is relatively similar across generative models, with Stable Diffusion and Kandinsky showing more compact distributions than Midjourney.
  • 8.4. Inpainting Localization: Reconstruction-error maps provide a good indication of the locations of inpainted regions across different scenes.Additional examples use Stable Diffusion 1.5 images, inpainting masks, and error maps computed with LPIPS2.
  • 8.5. Robustness to Perturbations: For perturbed images, higher LPIPS layers can outperform LPIPS2, possibly because they are less affected by detail loss; selecting the optimal layer for each perturbation improves the comparison.Perturbation strength varies by JPEG quality, crop factor, Gaussian blur, and noise standard deviation.

9. Analysis of DIRE

The DIRE experiments show that the reported near-perfect detection performance is driven by inconsistent compression formats rather than reliable separation of real and generated images. Matching the formats reduces performance to random guessing, revealing a training-data bias.

  • Compression bias: DIREs of fake images were stored as lossless PNGs, whereas DIREs of real images were stored as JPEGs with quality factor 95.The authors attribute this difference to the original file formats and warn that JPEG compression introduces an unwanted bias.
  • Variant 1: Following the original evaluation protocol reproduced very good detection performance and apparent generalization to other datasets.This result was obtained before correcting the inconsistent storage formats.
  • Variant 2: Converting fake DIREs to JPEG with quality 95 caused all classifiers’ performance to drop from almost perfect detection to random guessing.The only evaluation change was making generated-image DIREs use the same format as real-image DIREs.
  • Format control: When all DIREs were stored as PNG, labeling half of the generated images as real produced approximately 0.5 accuracy.This control experiment shows that the classifiers did not reliably distinguish the generated images themselves.
  • Format control: Converting the nominally real set to JPEG produced almost perfect classification, demonstrating that file format alone controlled the prediction.The images in that set were all generated, and only their storage format was changed.
  • Discussion: The authors conclude that the provided DIRE classifiers are highly sensitive to compression artifacts and recommend re-evaluating the experiments without inconsistent file formats.Their stated concern is an unwanted training-data bias between JPEG real DIREs and PNG generated DIREs.
Loading 2401.17879v2…