PaperlayerView exact revision on arXiv

Source-linked AI summary

NTIRE 2026 Challenge on Robust AI-Generated Image Detection in the Wild

Aleksandr Gushchin, Khaled Abud, Ekaterina Shumitskaya, Artem Filippov, Georgii Bychkov, Sergey Lavrushkin, Mikhail Erofeev, Anastasia Antsiferova, Changsheng Chen, Shunquan Tan, Radu Timofte, Dmitry Vatolin, Chuanbiao Song, Zijian Yu, Hao Tan, Jun Lan, Zhiqiang Yang, Yongwei Tang, Zhiqiang Wu, Jia Wen Seow, Hong Vin Koay, Haodong Ren, Feng Xu, Shuai Chen, Ruiyang Xia, Qi Zhang, Yaowen Xu, Zhaofan Zou, Hao Sun, Dagong Lu, Mufeng Yao, Xinlei Xu, Fei Wu, Fengjun Guo, Cong Luo, Hardik Sharma, Aashish Negi, Prateek Shaily, Jayant Kumar, Sachin Chaudhary, Akshay Dudhane, Praful Hambarde, Amit Shukla, Zhilin Tu, Fengpeng Li, Jiamin Zhang, Jianwei Fei, Kemou Li, Haiwei Wu, Bilel Benjdira, Anas M. Ali, Wadii Boulila, Chenfan Qu, Junchi Li

arXiv:2604.11487v1cs.CV

TL;DR

AI-generated image detectors must remain effective after realistic transformations, but existing benchmarks do not systematically combine broad generator coverage with such distortions. This report presents the NTIRE 2026 challenge, whose dataset and methods target robust detection through diverse data, large vision models, augmentation, and ensembles; the MICV team achieved the highest average Robust ROC-AUC at 0.9723, while the challenge results indicate that the problem remains unsolved.

  • Problem

    Existing AI-generated image detectors can be substantially degraded by real-world transformations, while benchmarks often lack broad generator and transformation coverage.

  • Method

    The challenge evaluates detectors on a dataset spanning diverse generators and transformations, while submitted solutions use diverse augmented data, large vision backbones, and complementary ensembles.

  • Results

    MICV achieved the highest average Robust ROC-AUC of 0.9723 and the best average clean ROC-AUC of 0.9974.

  • Takeaways & Limitations

    Challenge results show that robust detection benefits from model scaling, diverse augmented data, and complementary expert ensembling under real-world transformations.

  • Takeaways & Limitations

    The challenge conclusion states that the problem is not yet solved and remains open to advances in model design, training strategies, and data curation.

Abstract

from arXiv · show

This paper presents an overview of the NTIRE 2026 Challenge on Robust AI-Generated Image Detection in the Wild, held in conjunction with the NTIRE workshop at CVPR 2026. The goal of this challenge was to develop detection models capable of distinguishing real images from generated ones in realistic scenarios: the images are often transformed (cropped, resized, compressed, blurred) for practical usage, and therefore, the detection models should be robust to such transformations. The challenge is based on a novel dataset consisting of 108,750 real and 185,750 AI-generated images from 42 generators comprising a large variety of open-source and closed-source models of various architectures, augmented with 36 image transformations. Methods were evaluated using ROC AUC on the full test set, including both transformed and untransformed images. A total of 511 participants registered, with 20 teams submitting valid final solutions. This report provides a comprehensive overview of the challenge, describes the proposed solutions, and can be used as a valuable reference for researchers and practitioners in increasing the robustness of the detection models to real-world transformations.

1. Introduction

Photorealistic generative models have expanded AI-generated imagery, creating risks for media integrity and authentication. Existing detectors remain insufficiently robust to common transformations, motivating a benchmark spanning diverse generators and realistic post-processing.

  • Motivation: Photorealistic diffusion, GAN, and autoregressive generators have made synthetic images increasingly accessible and difficult to distinguish from photographs.Their widespread use raises concerns about media integrity, misinformation, digital forensics, and content authentication.
  • Prior Work: Existing detectors use generator-specific artifacts, diffusion residuals, or pretrained vision encoders fine-tuned on real/fake corpora.These approaches reflect the field’s progression from handcrafted artifact detection toward learned visual representations.
  • Robustness Gap: Real-world cropping, resizing, recompression, and blurring can substantially degrade detector performance.Images commonly undergo these operations before reaching deployed detectors.
  • Robustness Gap: Existing benchmarks often limit generator coverage, omit systematic transformations, or evaluate generators and transformations separately.Consequently, robust detection under realistic conditions remains a serious gap.
  • Challenge Scope: The challenge addresses this gap with 108,750 real images, 185,750 generated images from 42 generators, and 36 realistic image transformations.It evaluates detector robustness across varied open-source and closed-source architectures and post-processing conditions.
  • Challenge Scope: The report overviews submitted methods and their performance, with the stated aim of improving robustness and detection accuracy in critical applications.The challenge is presented as part of the broader NTIRE 2026 workshop program.

2. Challenge

The challenge evaluates general-purpose text-to-image detection across diverse generators and realistic degradation pipelines. Its dataset construction pairs broad generator coverage with evaluation on distorted and clean images using ROC AUC.

  • Task Goals: The task distinguishes text-to-image-generated images from real imagery across the general image domain rather than a specific object or face subdomain.The competition targets detection robustness, unseen-generator generalization, and the distinguishability of contemporary AI imagery.
  • Dataset: The dataset includes high-quality real-world imagery and AI-generated images from diverse generators, including recent open and proprietary systems.The generator range extends from older Stable Diffusion models to newer systems such as Nano Banana 2 and SeeDream 5 Lite.
  • Dataset: Real images are collected from CC12M, CommonPool, and RedCaps, then filtered for content, resolution, availability, and duplicate similarity.Approximately 12 million images were initially selected before additional quality filtering.
  • Dataset: Generated images come from 42 open-source and proprietary text-to-image generators, with prompts derived from captions of corresponding real images.Pairing generated images with real counterparts is intended to align semantics and content distributions.
  • Dataset: Validation and test splits reserve proprietary generators and use unique images without paired counterparts.The splits progressively increase the share of state-of-the-art models to assess generalization beyond training sources.
  • Evaluation: The robust track applies 1–5 randomly sampled consecutive distortions from groups including noise, compression, and blur.This track simulates artifacts that may conceal an image’s generated nature during deployment.
  • Evaluation: Robust ROC AUC is the primary metric on distorted images, while Clean ROC AUC is the secondary metric on non-distorted images.ROC AUC avoids requiring a predefined threshold to quantize confidence scores into binary predictions.

3. Challenge Methods and Teams

Challenge methods emphasize broad training data, large pretrained vision backbones, feature fusion, and hierarchical augmentation to address domain generalization under in-the-wild transformations.

  • Overview: The framework targets domain generalization and cross-platform detection through a robust ensemble-based design.Its overview identifies multiple complementary components rather than a single detector branch.
  • Data Strategy: Training data combine open-source benchmarks, synthetic images from current generators, and high-fidelity samples from closed-source commercial APIs.This hierarchical data strategy aims to cover diverse generative artifacts.
  • Data Strategy: The corpus includes open-source datasets and synthetic data from text-to-image, image-to-image, editing, and inpainting models.Examples include GenImage, WildFake, AIGIBench, CommunityForensics, So-Fake-Set, Qwen-Image, Z-Image, and FLUX.
  • Architecture: The feature-fusion architecture uses two independent streams built from separate committees of DINOv3 backbones.Each stream projects aggregated features into a latent space before an MLP head produces detection probabilities.
  • Augmentation: Hierarchical stochastic augmentation progresses from individual degradations to multi-stage combinations such as blur, noise, geometric shifts, and compression.The design is intended to bridge controlled benchmark distributions and challenging in-the-wild imagery.
  • Implementation: Training initializes pretrained DINOv3 backbones and fine-tunes them end to end with random crops and resizing to 512 × 512 pixels.The available implementation description also mentions a hierarchical augmentation pipeline.

3.2. Ant International

Ant International’s solution combines large-scale augmented data, DINOv3-7B scaling, and two complementary experts. Its design targets both clean accuracy and robustness through specialist training, pairwise optimization, and ensemble inference.

  • Design Principles: The solution follows three principles: massive diverse data, model scaling, and an expert ensemble with complementary training strategies.These principles organize the team’s approach to robust detection.
  • Data: The training set contains approximately 1 million images from the challenge set, self-generated images, and open-source detection datasets.Self-generated sources include LongCat-Image, Z-Image, Qwen-Image, and Qwen-Image-2512.
  • Data: A four-level offline augmentation pipeline ranges from clean images to heavy samples with six fixed distortions.Mild, moderate, and heavy levels progressively increase the number and severity of random distortions.
  • Backbone Scaling: Experiments found that larger vision backbones and higher input resolutions improved performance and generalization, leading to selection of DINOv3-7B.Compared backbones included eva02-large, eva-giant, siglip2-giant, and DINOv3-7B.
  • Architecture: The final model is a dual-expert ensemble of two independently fine-tuned DINOv3-7B models totaling 14B parameters.Both experts are fully fine-tuned and their detection scores are aggregated into a robust prediction.
  • Inference: Inference applies test-time augmentation separately to each expert before weighted averaging across experts.The full pipeline runs at approximately 2.21 images/s with 78.25 GB VRAM on one NVIDIA A100 GPU.
  • Conclusion: The conclusion attributes strong generalization under real-world transformations to model scaling, large augmented data, and complementary dual-expert ensembling.The two specialists are characterized as a high-resolution specialist and a robustness-focused specialist.
  • Alternative Method: LoRA-based Pairwise Training jointly uses clean and distorted images, correcting distorted-image features with an additional feed-forward network.Its loss combines cross-entropy, KL divergence, and mean squared error terms with α = 0.5 and β = 0.25.

3.4.1. Model Training Strategies

The training strategy progressively combines larger and more varied data, stronger distortions, higher resolution, backbone changes, and weighted ensemble corrections to improve robustness. Five models form a staged pipeline, with the final system combining their outputs and applying targeted inference adjustments.

  • Staged detector development: Five detectors are developed progressively, from DINOv3-Huge fine-tuning through expanded data, stronger distortion augmentation, a high-resolution branch, and MetaCLIP2 Giant partial fine-tuning.Model 4 uses 448×448 inputs, while Model 5 partially fine-tunes MetaCLIP2 Giant.
  • Staged detector development: The training pipeline uses official data, additional datasets, AdamW optimization, scheduled learning rates, cross-entropy, and weighted sampling to address class imbalance.The baseline combines official data with SoFake-OOD and RRDataset, while Model 2 adds Chameleon, GenImage, and AIGIBench data.
  • Staged detector development: Model 3 increases distortion augmentation from 3 distortions and 3 levels to 5 distortions and 5 levels while retaining augmentation probability 0.5.The enhanced augmentation continues from Model 2 and keeps other settings unchanged.
  • Ensemble and correction: The final logit uses hierarchical fusion, weighting the M1–M4 group at 70% and Model 5 at 30%, with M1, M2, and M3 receiving 75%, 15%, and 10% within the first group.Horizontal-flip test-time augmentation is applied to Models 3 and 4.
  • Ensemble and correction: Dual-gating correction shifts the output toward strongly agreeing Models 4 and 5 or excludes Model 4 when it disagrees with at least three other models.Gate-1 applies a 2.5 logit shift, while Gate-2 renormalizes the remaining weights.

3.4.3. Engineering Optimization

The engineering strategy combines parallel multi-model inference with asynchronous CPU–GPU overlap and a distortion-trained SigLIP2 classifier. Training preserves full image content, applies competition-specific distortions to every image, and uses pooled patch features for binary classification.

  • Inference engineering: Inference uses one CUDA stream per model, CPU-side multithreaded preprocessing, AMP for Models 1–4, asynchronous loading, and prefetching.These choices overlap CPU preprocessing with GPU inference to reduce idle time.
  • Feature extraction and classification: The SigLIP2 classifier uses the largest tested backbone, global average pooling over final-layer patch tokens, and a linear layer for real/fake logits.The selected backbone is siglip2-giant-opt-patch16-384.
  • Spatial preprocessing: The “squish” strategy directly resizes images to 384×384 and randomly flips them, preserving full image content instead of using random resized crops.The strategy ignores aspect ratio to avoid removing localized forensic cues.
  • Robust augmentation: Every training image receives distortion augmentation with up to three random post-processing operations sampled across five severity levels.The authors describe this aggressive augmentation as a key driver of Robust ROC AUC improvements.

4. Results

The evaluation verifies submissions in the official environment and ranks them by average Robust ROC-AUC across open and hidden test sets. Top methods exceed 0.99 ROC-AUC, with MICV leading overall and robustness separating the strongest teams from the rest.

  • Submissions were rerun in the official evaluation environment to verify consistency with the public leaderboard.
  • The final ranking uses average Robust ROC-AUC across the open and hidden test datasets.
  • 0.9723 average Robust ROC-AUC gives MICV first place, while its 0.9974 average clean ROC-AUC is also the best.
  • Ant International achieves the best hidden-test clean and robust ROC-AUC values, 0.9971 and 0.9711, respectively.
  • Robust ROC-AUC separates the top teams from others, whose clean scores near 0.98–0.99 fall to approximately 0.91–0.93 under distortions.

5. Conclusion

The challenge attracted more than 500 participants to develop detectors for a dataset exceeding 250,000 images. Results show substantial progress, but robust AI-generated image detection remains unsolved.

  • 500+ participants competed on a novel dataset containing 250,000+ images.
  • Most final solutions used Expert-base architectures with multiple models and Transformer-based architectures.
  • The results indicate that further advances in model design, training strategies, and data curation remain necessary.

7. Teams and Affiliations

The Reagvis Labs team includes eight members affiliated with IIT Mandi in India.

  • Reagvis Labs comprises eight listed members affiliated with IIT Mandi, Mandi, India.

8. Challenge Methods and Teams (Continued)

The submitted methods rely on complementary ensembles, robustness-oriented data and augmentation strategies, and fusion schemes designed for transformed images. RAPID combines heterogeneous detectors with staged logit fusion, while other teams use Transformer ensembles, paradigm diversity, and late probability fusion.

  • Reagvis Labs: RAPID is a cascaded six-model ensemble combining CLIP, SigLIP, SRM-style residual modeling, and EVA-02 representations.
  • Reagvis Labs: RAPID uses staged logit-space fusion, sequential execution below 4 GB peak VRAM, and validation ablations that retain stages only when robust AUC improves.
  • Reagvis Labs: RAPID applies eight-view test-time augmentation using geometric and degradation-aware transformations, including crops, blur, and JPEG perturbation.
  • Reagvis Labs: RAPID trains branches with random cropping, recompression, blur, noise, resizing, AdamW, cosine decay, warmup, EMA checkpointing, and parameter-efficient adaptation.
  • UESTC: The UESTC detector uses four Vision Transformer experts: two CLIP ViT-L/14 models and two SigLIP So400M Patch14-384 models.
  • UESTC: UESTC selects CLIP and SigLIP after comparing diverse backbones for representation quality, computational efficiency, and robustness to synthetic artifacts.
  • UESTC: UESTC expands training data with diffusion, reconstruction, domain-transfer, and adversarial synthesis pipelines, then uses feature-level self-distillation in a two-stage training strategy.
  • PRISM: PRISM targets robustness through heterogeneous representation paradigms, including contrastive, self-supervised patch, and supervised CNN features.

Labels Provided Generator Models Transformations

The dataset is organized into training, validation, hard, and public/private test splits, with generator models and image transformations specified for each split. The listed transformations include blur, noise, compression, cropping, downscaling, color changes, watermark attacks, and related distortions.

  • The training split contains approximately 277K images, uses an approximately 1:1.77 ratio, and includes 20 generator models.
  • The validation split contains 10K images at a 1:1 ratio, while the hard split contains 2.5K images at a 1:1 ratio.Both splits provide transformations after completion.
  • The dataset covers generators including diffusion, transformer-based, and proprietary models such as Qwen Image, Nano Banana, HiDream, FLUX variants, Stable Diffusion variants, and Kandinsky models.Proprietary models are marked with † and used via API.
  • Transformations include Gaussian and lens blur, color and brightness changes, noise, JPEG and neural compression, cropping, downscaling, perspective changes, pixelation, and watermark attacks.The listed transformation sets also include multiple-compression variants and invisible watermark insertion.
  • The public and private test splits each contain 2.5K images, with approximately 1:1 and 1:1 ratios, respectively.The public test provides transformations after completion, whereas the private test does not.
Loading 2604.11487v1…