Source-linked AI summary
Fusion Under Component Failure: Negative Results and Failure Modes in Ensemble AI-Generated Image Detection
Suraj Singh, Tushar Verma, Pragyan Singh, Shaurya Bhav, Shivam Kumar
TL;DR
Detector fusion is often proposed for off-distribution unreliability, but its value under calibration, corpus transfer, and real abstentions needs controlled evaluation. This paper tests a deployed stacker against those controls and finds that conclusions depend on refitting, while partial abstentions can produce dangerously confident outputs.
Problem
The paper examines whether detector fusion remains useful when compared fairly with a calibrated member, tested on a second corpus, and exposed to real abstentions.
Source: §1 · p. 1Method
Results
Refitting in-domain beats the best member plus a calibrator, while cross-corpus performance is indistinguishable from chance and partial abstentions can yield a confident wrong-direction verdict.
Source: §8 · p. 13Takeaways & Limitations
A quorum requiring two distinct architectures prevents both observed abstention failures without retraining, and fault handling should remain inspectable outside the learned component.
Source: §8 · p. 13Neither corpus contains controlled modern diffusion output, and the zero-shot meta-learner was fitted on a corpus of unknown composition that no longer exists.
Source: §7.2 · p. 12
Abstract
from arXiv · showhide
We built an ordinary stacking ensemble for AI-generated image detection -- three open detectors producing five scores, fused by a gradient-boosted meta-learner that treats a detector's failure as missing data -- deployed it, and then evaluated it against three controls it should have faced first. This paper reports what the controls found, including where they overturned our own earlier conclusions. Fusion is worth its cost only when refitted on the target domain. The shipped meta-learner, fitted on a separate corpus, does not beat its best single member on 2000 StyleGAN faces (AUC 0.9896 vs 0.9961; McNemar p = 1.000). But a stacker refitted in-domain beats that member plus a post-hoc calibrator (Delta-AUC = +0.0025, [+0.0014, +0.0038]; p = 3.4e-4). An earlier draft claimed the calibrated single detector won outright; that comparison mixed regimes and we correct it here. One corpus is not an evaluation. On 80 screenshots every model's AUC interval contains 0.5. We can say nothing stronger: the difference between the ensemble's drop and its best member's is [-0.185, +0.115]. Abstention is real, correlated, and mishandled. With four of five detectors silent and the survivor reporting "real", the system returns P(AI) = 0.9985, because an all-NaN input scores 0.9995 in a learner never fitted with missingness. The three AIDE checkpoints fail together, sharing one preprocessing path. A quorum rule requiring two distinct architectures prevents both failures with no retraining. We also find Corpus A carries a class-conditional JPEG bias severe enough to separate the classes from the header alone, which limits every in-domain number we report. Code, harness, hash-identified artifacts and all corrections are released.
1 Introduction
The paper tests whether detector fusion survives controls for calibration, cross-corpus transfer, and naturally occurring abstentions. Its corrected findings distinguish in-domain refitting from the shipped stacker and expose limits in the corpora and failure handling.
1 Introduction
- The study evaluates a deployed stacker against a calibrated single member, a second corpus, and naturally occurring rather than randomly injected abstentions.The system combines three open detectors' five scores with a gradient-boosted meta-learner that treats detector failures as missing data.Source: §1 · p. 1
- Refitted in-domain, the stacker beats its best member plus a calibrator, while the shipped zero-shot stacker does not beat its best member.The earlier claim that a calibrated single detector won outright mixed evaluation regimes and is corrected in the paper.Source: §1 · p. 2
- On Corpus B, every model's AUC interval contains chance, and the paired interval cannot resolve whether fusion drops more than its best member.The authors identify compression bias as a competing explanation for both corpora's results.Source: §1 · p. 2
- With four detectors silent and the survivor reporting “real,” the system returns P(AI) = 0.9985; an all-NaN vector scores 0.9995.The learner was never fitted with missingness, and abstentions cluster through shared preprocessing rather than occurring independently.Source: §1 · p. 2
- The failure catalogue reports eleven silent defects from one codebase, while the corpora cover StyleGAN faces and a small screenshot set without controlled modern diffusion output.The authors describe the catalogue as an experience report, not a survey.Source: §1 · p. 2
2 Related Work
Related work situates this study among passive detectors, fusion methods, and known dataset confounds. It also distinguishes the paper's internal comparisons from standard cross-generator evaluation and claims about published systems.
2 Related Work
- Prior work showed single-generator-trained classifiers transfer across CNN generators via shared upsampling artifacts [21], while unfamiliar generators can be absorbed as real; AIDE’s Chameleon benchmark found almost all off-the-shelf detectors classify hard AI images as real [23].Source: §2 · p. 2
- Fixed-rule analysis identifies max fusion as sensitive to one over-confident member, and diversity work formalizes the disagreement measure used here.The paper frames its fusion-rule findings as replication in a heterogeneous open-detector stack.Source: §2 · p. 2
- Prior work documents compression-history confounds between real and synthetic classes [8], and this paper reports the same pattern in Corpus A.The paper calls its compression-error correlate confirmation of that line rather than a new finding.Source: §2 · p. 2
- The paper relates its correlated-abstention observation to N-version programming work on independently built components failing together.It presents the detector-ensemble observation as an empirical instance of that effect.Source: §2 · p. 2
- GenImage offers over a million real/fake pairs across seven modern generators and explicit cross-generator protocols, an evaluation this work lacks [24].The paper reports only internal comparisons and no numbers comparable to published detectors; its corpora are not standard benchmark datasets.Source: §2 · p. 3
3 The System
Quorum stacks five scores from three heterogeneous detectors, with explicit rules for missingness and a single verdict authority. Its abstention contract handles total failure but leaves partial abstention to the meta-learner's defaults.
3 The System
- Quorum uses three heterogeneous detectors to produce five scores, then fuses them with a gradient-boosted tree ensemble.Its stated design commitments are the abstention contract and single-authority rule.Source: §3 · p. 3
3.1 Detectors and scores
- Three models emit five scores because AIDE contributes three checkpoints over one shared architecture; the authors do not treat these as five independent experts.The AIDE checkpoints sharing an architecture are the system's least diverse pair, and architectural rather than checkpoint diversity produces independent errors.Source: §3.1 · p. 3
3.2 Missingness-aware fusion
- The meta-learner maps abstentions to NaN, and gradient-boosted trees route missing values through learned default branches rather than treating them as scores.This is the mechanism intended to keep abstention distinct from evidence.Source: §3.2 · p. 3
3.3 The abstention contract
- The contract raises on total failure, but with one to four abstentions it emits a live probability from unfitted defaults, potentially an inverted answer.The paper's vocabulary distinguishes failure-induced missingness from a classifier's uncertainty-based reject option.Source: §3.3 · p. 4
3.4 Implementation
- Quorum runs as one Python package with a shared execution path, resident weights, batched expert inference, and offline inference after warm-up.PDF pages are rasterized at twice native resolution and scored as images.Source: §3.4 · p. 4
4 Silent Failures: An Experience Report
The experience report catalogs silent defects in one implementation, including hardware and preprocessing failures that can corrupt verdicts without visible errors. It argues for representing failure as a distinct type, while noting this alone does not determine safe fusion behavior.
4 Silent Failures: An Experience Report
- On Apple Silicon, PyTorch's MPS backend returned all-NaN AIDE logits while the same computation on CPU returned correct values; a load-time probe is the stated mitigation.The resulting missing features were routed through learned defaults, and a document received P(AI) = 1.00 and P(AI) = 0.02 on different runs.Source: §4 · p. 4
- Treating NaN as valid missingness leaves the degraded flag unset, so a verdict appears to have more supporting experts than it does.The learner cannot distinguish a genuinely missing feature from an unlogged non-finite score.Source: §4 · p. 5
- Other defects included inverted Swin label polarity, divergent fusion rules, filename-derived feature names, destructive retraining, row duplication, filename collisions, and device-dependent preprocessing.The cited incidents include silent verdict changes, corrupted training data, and an MPS-specific AIDE crash.Source: §4 · p. 5
- Nine of eleven defects represented failure as a normal-range value; the proposed mitigation is a distinct failure type tested directly, but correct typing alone is insufficient.The catalogue is an existence report from one team and codebase, not evidence of how prevalent these defects are elsewhere.Source: §4 · pp. 4–5
5 Experimental Setup
The experiments compare two distinct corpora and keep zero-shot evaluation separate from in-domain refitting. They also test injected and naturally induced abstentions under controlled scoring and selection procedures.
5.1 Corpora
- Corpus A contains 2,000 balanced StyleGAN-face and FFHQ images, but covers only aligned faces from one GAN family and no diffusion imagery.The classes share an origin, so alignment and framing are not confounded; their JPEG histories are badly confounded.Source: §5.1 · p. 5
- Corpus A has zero filename overlap with the meta-learner’s 67,231-image training corpus, but renamed or re-encoded duplicates cannot be excluded.The paper therefore describes it as held out only as far as can be verified.Source: §5.1 · p. 5
- On Corpus B’s 80 screenshots, every model’s confidence interval contains chance; the small, imbalanced, externally labelled set is not reproducible from released scores alone.Its undocumented provenance and lack of redistributable images constrain inspection and verification.Source: §5.1 · p. 6
5.2 Protocol
- The protocol reports zero-shot and in-domain cross-validation separately, with refitted models scored out of fold and paired comparisons using exact McNemar tests.Confidence intervals use image-level bootstrap resampling; calibration is measured by expected calibration error over 10 equal-width bins.Source: §5.2 · p. 6
5.3 Abstention experiments
- Because neither corpus produced a natural abstention, the study compares injected random missingness at 0%, 10%, 25%, and 50% with 14 induced preprocessing failures.Injected tests compare native, zero-imputed, and mean-imputed handling; induced failures retain the detectors’ actual correlation structure.Source: §5.3 · p. 6
5.4 Environment
- The evaluation uses seeded runs, with AIDE on CPU and the remaining detectors on MPS; best-single selection and Youden thresholds are fitted on training folds only.Fold-level detector selections are reported to reveal baseline instability.Source: §5.4 · p. 6
6 Results
The results compare zero-shot fusion with its best detector, then test a calibrated single detector and a second corpus. The findings depend on whether fusion is refitted in-domain and on which corpus is evaluated.
6.1 Corpus A: per-detector and fused
- AUC is 0.9896 for zero-shot fusion versus 0.9961 for AIDE-PROGAN; their McNemar test is indistinguishable (p = 1.000).Across nested folds, AIDE-PROGAN was selected unanimously and led in accuracy, 0.9640 against 0.9510 for the ensemble.Source: Figure 1 · p. 7, §6.2 · p. 7, §6.1 · p. 7
6.2 Control 1: a calibrated single detector
- ∆AUC = +0.0025 [+0.0014, +0.0038]: refit fusion beats the Platt-calibrated detector in-domain; accuracy is 0.9805 vs 0.9660 (p = 3.4 × 10−4).Against isotonic calibration, refit fusion gains ∆AUC = +0.0039 [+0.0022, +0.0060] (p = 2.3 × 10−4); the ECE intervals for isotonic and fusion overlap.Source: §6.2 · p. 7, Table 3 · p. 8
6.3 Control 2: a second corpus
- On Corpus B, ensemble AUC is 0.4107 and accuracy 0.5000; every model’s interval contains 0.5, and the drop-difference interval [−0.1849, +0.1151] includes zero.The point estimates do not establish genuinely inverted performance or that fusion degrades more than its best member.Source: §6.3 · p. 8, Table 4 · p. 8
- AIDE-PROGAN falls from AUC 0.9961 on Corpus A to 0.4563 on Corpus B, a drop of 0.5397.Its ProGAN training distribution matches Corpus A’s StyleGAN generator closely, unlike the second corpus.Source: §6.1 · p. 7, §6.3 · p. 8
- Corpus B’s accuracy baseline is 0.625, the majority-class rate; the ensemble’s 0.5000 accuracy is below it.The ensemble’s AUC interval contains 0.5.Source: §6.3 · p. 8
6.4 A confound in Corpus A
Corpus A’s classes are separable by JPEG headers alone, weakening its in-domain results. Tests of constructed failures show that partial abstention can produce inverted fusion probabilities, while architecture-based supervision prevents the observed inversions.
6.4 A confound in Corpus A
- Each Corpus A class has a distinct JPEG quantisation table, making labels separable from headers alone and materially weakening in-domain results.Three of five detectors consume SRM residuals, which JPEG quantisation alters.Source: §6.4 · pp. 8–9, Table 5 · p. 9
- Corpus B’s collapse is equally consistent with losing a compression cue as with failed domain transfer; identical re-encoding and rescoring remains undone.The reported compression correlate is confounded because compression already tracks labels in Corpus A.Source: §6.4 · p. 9
6.5 Control 3: abstentions that actually occur
- Most tested colour, depth, size, animation, and truncated-file pathologies were handled without abstention; genuinely unreadable inputs raised rather than returning a verdict.No case produced an uncaught exception.Source: §6.5 · p. 9
- On 1×1 and 4096×3 inputs, fusion returned P(AI) = 0.9985 and 0.9991 despite live detectors reporting “real”.Four of five detectors abstained on the 1×1 image; three abstained on the sliver.Source: §6.5 · p. 9
- All three AIDE checkpoints abstained together because they share a DCT preprocessing path, so independent missingness injection was optimistic about observed failures.Geometric degeneracy breaks patch extraction for all three checkpoints at once.Source: §6.5 · p. 9
- A quorum requiring two distinct architectures and a survivor-mean fallback prevent both observed inversions without retraining.On the 1×1 image quorum abstains; on the sliver survivor-mean returns 0.2535, agreeing with both live detectors.Source: §6.5 · p. 9
6.6 Why: what a substituted value asserts
An unfitted missing-value default can turn absent evidence into a confident prediction. Comparisons across missingness policies and fusion rules show the risks of that choice and the limited contribution of several ensemble components.
6.6 Why: what a substituted value asserts
- An all-NaN vector yields P(AI) = 0.9995, nearly as extreme as an all-zero vector’s 0.0006, because missingness was absent during fitting.The model’s default branch directions were never estimated for absent evidence.Source: §6.6 · pp. 9–10
6.7 Injected missingness, for comparison
- Under MCAR injection, zero-imputation drives mean P(AI) to 0.2056 at 50% missingness, NaN to 0.7557, and mean-imputation stays nearest calibrated and best on accuracy.When refitted under each policy, the policies converge to within 0.002 AUC.Source: §6.7 · p. 10
6.8 Fusion rules and detector redundancy
- Max fusion reaches 0.7185 accuracy, 22.9 points below learned fusion, inheriting NONESCAPE’s 396 false positives.There were 497 images correct only for the ensemble versus 40 for max; p ≈ 2 × 10^-101.Source: §6.8 · p. 10
- Logistic regression matches XGBoost in-domain with overlapping intervals; XGBoost’s role is missing-value handling, which is a liability when unfitted with missingness.Source: §6.8 · p. 10
- Removing both cheap AIDE checkpoints costs ∆AUC = 0.0000, while the least-disagreeing pair, AIDE-SD14 and AIDE-GENIMAGE, shares an architecture.Mean pairwise disagreement is 0.342; the pairwise value for AIDE-SD14 and AIDE-GENIMAGE is 0.141.Source: §6.8 · p. 10
- VQGAN/Swin contributes ∆AUC = −0.0003 and predicts “real” for all 80 Corpus B images, including all 30 AI images.It is retained only because the shipped meta-learner was fitted with it present and cannot be refitted.Source: §6.8 · p. 10
6.9 What the errors look like
The ensemble’s Corpus A errors correlate most clearly with compression, while many natural-image mistakes remain uncertain. The section also reports substantial inference cost and a prevalence-sensitive reversal in precision.
6.9 What the errors look like
- 106 of 2000 Corpus A images are misclassified: 66 false positives and 40 false negatives.Source: §6.9 · p. 11
- Misclassified images were significantly more compressed than correct images: median compression was 0.2574 versus 0.3589 bytes/pixel (Cohen’s d = −0.60, p = 2.3 × 10−7).Source: §6.9 · p. 11
- Only 7 of 106 mistakes are confident, while 32 lie within 0.1 of the decision boundary.Source: §6.9 · p. 11
6.10 Computational cost
- AIDE takes 4.244 s per image batched versus 0.047 s for the other two detectors combined; two cheap AIDE checkpoints use roughly two-thirds of inference time for ∆AUC ≤ 0.0001.Most of AIDE’s cost is its three-checkpoint S1 fallback running on CPU.Source: §6.10 · pp. 11–12
6.11 Sensitivity checks
- At 1% prevalence, AIDE-PROGAN precision is 0.5652 versus 0.1281 for the ensemble, whose false-positive rate is 9.4× higher.The authors advise practitioners to derive thresholds from their own base rate.Source: §6.11 · p. 12
7 Discussion and Limitations
The authors support narrow conclusions about refitted fusion, cross-corpus evaluation, and abstention handling, while withdrawing earlier claims that mixed regimes or overread uncertain differences. They emphasize that the evidence is bounded by the corpora, artifacts, and tests used.
7.1 What these results support
- The evidence supports that foreign-corpus stacking earns nothing over its best member, in-domain refitting beats that member plus a calibrator, and constructed abstentions are mishandled but preventable.Source: §7.1 · p. 12
- The paper withdraws claims that a calibrated single detector beats fusion outright or that fusion amplifies distribution shift, and makes no state-of-the-art claim.The comparison mixed regimes, and the difference interval spans zero; no published detector was tested on its own benchmark.Source: §7.1 · p. 12
7.2 Limitations
- Neither corpus contains controlled diffusion output, so the per-detector rankings should not be assumed to hold for Stable Diffusion or Midjourney.Source: §7.2 · p. 12
- Corpus B has only 80 externally labelled images with wide intervals, and two corpora cannot estimate corpus-level variance.The authors draw only the interval-level conclusion that every model’s interval contains chance.Source: §7.2 · p. 12
- The zero-shot meta-learner is an uncontrolled artifact fitted on a corpus of unknown composition that no longer exists, limiting attribution of its collapse to stacking generally.Source: §7.2 · p. 12
- The Corpus B collapse may reflect losing a compression cue rather than failed transfer; identical re-encoding and rescoring remains undone.The paper also reports no adversarial evaluation, including deliberate recompression attacks.Source: §7.2 · pp. 12–13
- The work was not preregistered, and its 14 constructed pathologies establish mishandling but do not estimate real-stream frequency.Analytic choices were made with the data in view.Source: §7.2 · pp. 12–13
7.3 Implications
- The authors recommend comparing ensembles with their best member plus a calibrator, and favor a fixed, inspectable supervisory rule for observed faults over relying on learned defaults.A quorum-by-architecture rule and survivor-mean fallback prevent both observed inversions without retraining.Source: §7.3 · p. 13
8 Conclusion
Three controls reversed the paper’s conclusions twice, leaving fusion worthwhile only after target-domain refitting while exposing unresolved corpus and failure-handling risks.
8 Conclusion
- The in-domain stacker beats its best member plus a calibrator on AUC and accuracy, with a paired interval excluding zero.The earlier comparison mixed an in-domain calibrator with a zero-shot ensemble, contrary to the protocol.Source: §8 · p. 13
- A stacker frozen from a foreign corpus earns nothing over its best member; the calibrated-member control revealed this narrower result.The controls changed the conclusions twice, with the second comparison moving them back toward fusion.Source: §8 · p. 13
- On the second corpus, every model’s AUC was indistinguishable from chance, and a paired bootstrap spanning zero led the authors to withdraw the claim that fusion amplified the shift.A class-conditional JPEG quantisation-table bias in Corpus A remains a competing explanation for the collapse and limits every reported in-domain number.Source: §8 · p. 13
- With four detectors silent and the survivor reporting “real,” the system returned near-certainty in the wrong direction; a two-architecture quorum prevented both observed failures without retraining.The three AIDE checkpoints failed together through a shared preprocessing path, while NaN inputs were treated as confident assertions by a learner never fitted with missingness.Source: §8 · p. 13
- The authors recommend comparing regimes honestly, measuring corpus biases before evaluation, and treating fusion behavior under component failure as unverified until tested.Their system was confidently wrong in a way an accuracy metric would not have shown.Source: §8 · p. 13
Reproducibility
The released artifacts and score tables support reproducible analysis, but the missing training corpus limits inspection and reproduction of the zero-shot model’s fit.
Reproducibility
- Every Section 6 experiment is recomputed from released per-image detector-score tables, so analysis reproduces without a GPU or rerunning detectors.A checking script verifies that every printed number appears in released experiment output.Source: Reproducibility · p. 13
- The fitted meta-learner and artifacts are released with SHA-256 identifiers, allowing zero-shot results to be reproduced by rerunning the fixed model.The release lists the model, feature, and corpus score artifacts by filename and digest.Source: Reproducibility · pp. 13–14
- Because the training corpus no longer exists, the zero-shot model cannot be refitted or inspected, and its cross-corpus collapse cannot be attributed to stacking generally.The claim that evaluation corpora were unseen in training is inferred from filenames and domain coverage, not verified; overlap cannot be excluded.Source: Reproducibility · p. 14
- In-domain cross-validated results reproduce end to end from released score tables, unlike the uncontrolled zero-shot artifact’s training process.The score-table analysis requires neither GPU access nor detector reruns.Source: Reproducibility · pp. 13–14
- The pickle can execute arbitrary code and may stop loading under future XGBoost versions; the native JSON export is data-only and reproduces its predictions bit-for-bit.The authors recommend the JSON export and retain the pickle because it produced the reported numbers.Source: Reproducibility · p. 14
- Detector weights come from their original publishers and are not redistributed; public corpora, seeds, fold assignments, hyperparameters, and software versions are recorded.Exact software versions and experiment settings are in the released configuration.Source: Reproducibility · p. 14