REALIS: A Curated Dataset for Studying the Challenges of AI Image Detection

• Reliable detection must hold across unfamiliar generators, differing image content, and the processing common to online media.The paper frames this reliability as crucial for applications such as media forensics and content moderation.Source: §1 · p. 1
• Existing benchmarks may reward dataset-specific cues, generalize poorly to unseen generators, and test robustness only against simple processing (Grommelt et al. (2025); Rajan et al. (2025); Ojha et al. (2023); Ren et al. (2026); Wang et al. (2020a); Corvi et al. (2023)).Neural compression and watermarking can suppress forensic traces or create artifacts that trigger false positives.Source: §1 · p. 1
• REALIS contains 1.43 million real and synthetic images from 42 modern text-to-image generators, with fake images prompted from real images to align content.Strict real-image curation, symmetric filtering, stratified sampling, and prompt-disjoint splits aim to reduce class-specific biases while preserving semantic diversity.Source: §1 · pp. 1–2
• REALIS addresses benchmark gaps in content alignment, generator bias, and modern post-processing within one dataset and controlled framework.Earlier datasets expanded coverage on some axes but lacked support for content alignment and generator biases, and used only simple post-processing strategies.Source: §1 · p. 1
• Experiments with 35 detectors show even mild processing sharply reduces performance, largely through increased false positives on real images.The protocol covers 35 transformations in eleven groups and five severity levels, including neural, compound, and held-out transformations.Source: §1 · p. 2

Datasets and Cross-Generator Generalization

• REALIS curates 42 contemporary open and proprietary generators into generator-aware splits, addressing the lack of controlled cross-family evaluation across architectures, quality levels, and proprietary systems.Earlier benchmarks expanded generator breadth or temporal generalization, while Community Forensics Park & Owens (2025) showed that training-generator diversity improves generalization.Source: §2 · p. 2

Robustness to Image Processing

• REALIS evaluates 35 transformations in stochastic chains at five severity levels, with paired clean and processed images to isolate distortion severity and cumulative effects.Prior work includes basic distortions in GenImage, social-platform transmission and re-digitization in TrueFake Dell’Anna et al. (2025) and RRDataset Li et al. (2025a), and the 42-generator, 36-transformation NTIRE 2026 challenge Gushchin et al. (2026).Source: §2 · p. 2

• Table 3 characterizes REALIS as combining general-content coverage, recent generators, easy access, and extensive robustness evaluation, rather than emphasizing only generator breadth or temporal generalization.Source: §2 · p. 2

3.1 DATASET CONSTRUCTION

• The construction pipeline filters real images, generates images from their derived prompts, samples Train/Val/Test/Expert splits, and applies chained degradations to evaluation splits.Figure 1 summarizes these four stages.Source: §3.1 · pp. 2–3, Figure 1 · p. 3

3.1.1 REAL IMAGE SOURCING

• REALIS filters 13M candidate real images through deduplication, quality, composition, provenance, and VLM checks, retaining 2.9M images (about 22%).Shared thresholds derived from the real-image distribution are later applied symmetrically to real and generated images to reduce class-specific shortcuts.Source: §3.1.1 · p. 3, §3.1.3 · p. 4

3.1.2 FAKE IMAGE GENERATION

• REALIS derives prompts from real images and assigns each unchanged prompt to 3–4 generators among 42 open-source and proprietary models spanning multiple generative paradigms.A VLM creates a dense description and an instruction-tuned LLM rewrites it as a generation prompt; the model set excludes older GANs because they followed prompts poorly and were nearly perfectly detected.Source: §3.1.2 · pp. 3–4

3.1.3 DATASET SAMPLING AND SPLIT CONSTRUCTION

• Mean ROC-AUC across pretrained detectors falls from 0.826 to 0.809 on the Expert density-filtered pool, to 0.723 for the hardest generators, and to 0.716 for quality-filtered images, versus 0.871 on training.REALIS-Expert uses density-based selection, while REALIS-Base uses equal-quota sampling across 20 clusters to preserve source-distribution diversity; the Base split contains 1.1M training images and balanced 100k validation and test sets.Source: §3.1.3 · pp. 4–5

3.1.4 IMAGE DEGRADATION PIPELINE

• The degradation pipeline applies 35 transformations across eleven groups at five severity levels, chaining 1–5 randomly ordered groups per image.REALIS-Train augmentation is restricted to classical transformations, holding out neural codecs, recompression chains, adversarial attacks, and watermarking for evaluation.Source: §3.1.4 · p. 6

3.2 BENCHMARK

• The benchmark evaluates off-the-shelf specialized detectors, REALIS-Train fine-tuned detectors, and zero-shot vision-language models, primarily using ROC-AUC.It also measures cross-benchmark ranking transfer and reports false-positive and false-negative rates, recall, and F1 for operating-point analyses.Source: §3.2 · p. 6

4.1 DATASET CONTENT, DIVERSITY, AND COMPLEXITY

• REALIS splits exceed compared T2I benchmarks on Vendi and Participation Ratio diversity, while REALIS-Expert has the highest Vendi score and the smallest real–synthetic Fréchet gap among compared detection datasets except XPlainVerse.REALIS-Expert maintains broad content coverage, but a small Fréchet distance alone does not eliminate residual shortcuts.Source: §4.1 · p. 6

4.2 OVERALL PERFORMANCE

• Off-the-shelf RINE reaches 97.34% ROC-AUC on GenImage but 44.3% on Expert-distorted, while REALIS-tuned DMID reaches 98.5% on clean Test; ProDet’s near-chance REALIS AUCs follow failed convergence.Strong external-benchmark performance does not necessarily transfer to Expert-distorted, which remains challenging for DMID as well.Source: §4.2 · p. 7

4.3 GENERALIZATION ACROSS GENERATORS

• Generator transfer varies widely: SD 3.5 Large-Turbo and Imagen 4 Ultra are relatively easy on Expert, whereas Kandinsky 5 and Z-Image-Turbo challenge most detectors, regardless of training exposure.Held-out Playground v2.5 is among the easiest Test generators, exceeding several generators represented in training.Source: §4.3 · p. 7, Figure 4 · p. 7
• Shared autoencoders and acceleration do not reliably predict transfer difficulty, and high AUC can coexist with poor fixed-threshold recall: DMID gets about 0.92 AUC but detects only 35% of FLUX.1-dev SRPO images at threshold 0.5.FREQNET is weak on many generators yet has the highest plotted AUC on Kandinsky 5; architecture, training setup, and sample selection cannot be isolated by these comparisons.Source: §4.3 · p. 7

4.4 PERFORMANCE ACROSS CONTENT AND IMAGE CHARACTERISTICS

• Across seven open-source Expert generators, category-averaged AUC varies by approximately 0.31 across generators versus 0.05 across content categories, making generator identity the stronger correlate of detection difficulty.Kandinsky 5 remains difficult and SD 3.5 Large-Turbo comparatively easy across the taxonomy; content still produces smaller measurable variation.Source: §4.4 · p. 8, Figure 5 · p. 8
• Balancing generator contributions markedly shrinks statistic associations with estimated noise variance, high-frequency energy, and aesthetics, while more detected objects and faces accompany higher generator-balanced AUC but not necessarily more face-containing fakes flagged.At threshold 0.5, additional faces accompany fewer false positives on real images, while the false-negative rate stays similar or increases.Source: §4.4 · p. 8
• The two highest resolution bins have lower AUC and substantially more missed synthetic images despite relatively low false-positive rates, an association that persists after generator balancing but may reflect depicted content.These characteristic-specific error patterns show why a single aggregate score is insufficient.Source: §4.4 · p. 8, Figure 5 · p. 8

4.5 ROBUSTNESS TO POST-PROCESSING

• Post-processing causes sharp detection losses, often toward chance, and clean performance predicts only part of robustness: generator-balanced clean and processed AUC correlate at Spearman ρ = 0.81, yet UFD retains about 0.76 AUC versus DMID’s 0.63.Conventional detectors generally incur more false positives and false negatives; compression and JPEG degradation especially increase misses. The VLM shifts toward generated labels across distortion groups, with more false positives and fewer false negatives. Mixed recompression, glass blur, and shot noise rank among the largest AUC losses; stronger blur and JPEG compression generally worsen discrimination, while repeated recompression is damaging even at its lowest setting. Co-occurring transformations characterize processing chains, not individual causal effects.Source: Table 1 · p. 7, §4.5 · pp. 8–9, Figure 6 · p. 9

5 CONCLUSION

• 0.752 ROC-AUC is the best tuned detector’s result on REALIS-Expert’s processed open-source component.The conclusion also reports substantial processing-related degradation for specialized detectors and zero-shot VLMs, including increased false positives on real images.Source: §5 · p. 9
• REALIS contains 1.43 million images from 42 text-to-image generators and supports paired clean-versus-processed robustness evaluation.REALIS-Expert targets closely matched class distributions without using detector predictions for selection; dataset construction reduces real–synthetic semantic and quality differences while preserving content diversity.Source: §5 · p. 9

AI USE STATEMENT

• The authors used generative AI for image generation, prompt rewriting, dataset curation, zero-shot detection, writing polish, and literature search, with outputs and references checked manually.The authors state that they take full responsibility for the paper’s content.Source: AI USE STATEMENT · p. 10

REPRODUCIBILITY STATEMENT

• A partial dataset release was available for double-blind review, with the full dataset planned for release upon acceptance; dataset-generation and detector-evaluation code was available.The passage attributes the partial release to the practical challenges of fully anonymizing the dataset.Source: REPRODUCIBILITY STATEMENT · p. 10

A Yakushev, A Akimenkov, K Abud, D Obydenkov, I Serzhenko, K Aistov, E Kovalev, S Fomin,

• The bibliography includes works on watermarks for generated images, AI-generated image detection, and generalizable detection methods.The supplied bibliography passages include Wibe, a sanity-check study, and orthogonal subspace decomposition for generalizable detection.Source: A Yakushev, A Akimenkov, K Abud, D… · p. 17

B DATASET DETAILS

• Appendix B details dataset comparisons, prompt synthesis, generator selection, filtering, and split construction.The appendix contents also identify prompt-generation instructions, generators by split, and the post-processing pipeline.Source: A CONTENTS · p. 18

A CONTENTS

• The appendices extend detector evaluation with per-generator and fixed-threshold results, examine image characteristics and generator profiles, and analyze post-processing sensitivity.The sensitivity analysis includes transformation strength and a separate validation-sample ablation.Source: A CONTENTS · p. 18

B.1 COMPARISON WITH EXISTING DATASETS

• REALIS combines 2.2 million real and 8.8 million synthetic images from 42 sources, including 12 closed models, with general-content coverage and extensive post-processing.Dataset counts and qualitative categories follow the respective dataset descriptions and may use different counting conventions.Source: §B.1 · pp. 18–19

B.2 PROMPT SYNTHESIS

• Every synthetic image is generated from a prompt describing a specific real image, reducing class content gaps that can let detectors rely on subject matter instead of synthesis artifacts.The passage warns that accuracy under such a content gap says little about deployment behavior.Source: §B.2 · p. 19
• Prompts pair VLM-generated dense descriptions with instruction-tuned LLM rewrites that preserve entities, counts, relations, and on-image text while targeting ∼35–50 words.The instructions prohibit invented details and quality adjectives, prioritize which material to drop when over budget, and aim to fit CLIP-based encoders’ 77-token context.Source: §B.2 · p. 19
• Each prompt is sent unchanged to 3–4 randomly selected generators, avoiding model-specific prompt or parameter tuning; the full pool has 2.96M prompts and ∼8.4M generated images.This gives each real image 3–4 content-matched synthetic counterparts in the unfiltered pool.Source: §B.2 · p. 19

B.3 T2I MODELS SELECTION

• The 42-generator selection comprises 33 open-source and 9 proprietary models, chosen for generative paradigm, scale and recency, and inference-time compute regime.The selection is intended to represent the contemporary text-to-image landscape rather than one architectural paradigm, training regime, or organizational lineage.Source: §B.3 · pp. 19–20
• Generator coverage spans latent and cascaded pixel-space diffusion, flow matching, autoregressive and visual-autoregressive synthesis, and unified multimodal models.The section describes coverage across Stable Diffusion, PixArt, FLUX, and other model families, alongside alternative training recipes and architectures.Source: §B.3 · p. 20
• Older GANs are omitted because they poorly follow the pipeline’s specific prompts and are nearly perfectly separable by most evaluated detectors, which could inflate accuracy and restore content gaps.The section names DF-GAN and GALIP as examples from preliminary experiments.Source: §B.3 · p. 20
• The selection spans generations within model lineages, research ecosystems, and a proprietary tier intended to capture the closed-source frontier used in practice.The authors argue that organizational and geographic diversity matters because models inherit cultural, linguistic, and visual priors from their data pipelines.Source: §B.3 · p. 20

B.3.1 DATASET SAMPLING AND SPLIT CONSTRUCTION

• Symmetric filtering applies real-distribution percentile thresholds and shared geometry bounds, while a VLM quality gate removes generated images scoring below 6.5 on any axis, leaving 4.2M images.The remaining pool contains 1.3M real and 2.9M generated images and supplies all splits.Source: §B.3.1 · p. 20
• A shared representation combines CLIP embeddings, YOLO detection counts, VLM content tags, and quality, aesthetic, structural, geometric, color, and forensic features, then projects them to 12 dimensions.Block-wise reductions and equalized distance contributions precede a linear PCA retaining 97.3% of variance, fitted on a class-balanced subsample.Source: §B.3.1 · p. 21
• REALIS-Expert selects images near the local class-density decision boundary, where classifiers using the chosen features are expected to be maximally uncertain.This difficulty guarantee is relative to the feature space, not pixel space; low-level forensic fingerprints may still distinguish the images.Source: §B.3.1 · p. 21
• 0.826 to 0.809 average ROC-AUC after density filtering, 0.723 for the strongest generators, and 0.716 after the final VLM gate, versus 0.871 on Train; Expert contains 130k images (60k real, 70k generated).The density-retained pool keeps about 12% of images, and the final Expert sample spans 16 hard open-source and proprietary generators.Source: §B.3.1 · p. 21
• The density signal correlates negatively with generated-image detection error, reaching PLCC −0.15 for UFD and −0.13 for SAFE and RINE, while selection avoids relying on current detectors’ blind spots.The criterion depends only on image data, not pretrained detector predictions, to avoid defining difficulty around existing models.Source: §B.3.1 · p. 21
• Base splits use 20 clusters with equal quotas to preserve diversity across content types; REALIS-Base contains 1.3M images across 30 open-source generators.Train has 1.1M images (505k real, 595k generated), while validation and test each have 100k balanced images.Source: §B.3.1 · pp. 21–22
• Real images and all their generated counterparts remain in one prompt-level split, and pretrained-detector mean ROC-AUC declines from 0.871 on Train and 0.854 on Val to 0.836 on Test and 0.716 on Expert.Prompt-level disjointness prevents near-isosemantic content from straddling train and test boundaries.Source: §B.3.1 · p. 22

C PROMPT GENERATION INSTRUCTIONS

• Qwen3-30B-A3B rewrites captions into English prompts of one to three sentences and at most 50 words, prioritizing content type, counts, subjects, actions, relations, and relevant scene or domain details.Instructions require exact transcription and location for mentioned on-image text, prohibit invented details or quality words, and specify what details to trim when over the word limit.Source: C PROMPT GENERATION INSTRUCTIONS · p. 22

D GENERATOR INVENTORY ACROSS SPLITS

• Five generators appear in all three base splits, enabling seen-versus-unseen generator comparisons within the same evaluation split; two others are shared by validation and test.The five are DeepFloyd IF, FLUX.1-Kontext-dev, Infinity-8B, OmniGen2, and Ovis-Image; Playground v2.5 and Lumina-Image-2.0 are shared by validation and test only.Source: D GENERATOR INVENTORY ACROSS SPLITS · p. 22
• Older models are concentrated in training, while validation and test add newer generators; REALIS-Expert contains models released from late 2024 onward and all proprietary generators.Among REALIS-Expert’s open-source models, only HiDream-I1-Full also appears in a base split, specifically Test.Source: D GENERATOR INVENTORY ACROSS SPLITS · p. 22, Table 4 · p. 23

E COMPLETE LIST OF POST-PROCESSING TRANSFORMATIONS

• The pipeline uses 34 transformations in ten groups, sampling 1–5 groups per image and applying one uniformly selected transformation from each group in sequence.Each selected transformation receives an independently sampled severity level; levels 1–5 occur at about 13%, 17%, 22%, 25%, and 23% in released splits.Source: E COMPLETE LIST OF POST-PROCESSING… · p. 23
• After the transformation chain, images may receive an invisible watermark and random downscaling, then are saved as quality-95 near-lossless JPEG with the full chain logged.Watermarking is applied with probability 0.35, and downscaling by a factor in [0.3, 0.8] with probability 0.75.Source: E COMPLETE LIST OF POST-PROCESSING… · p. 23
• The released validation, test, and Expert splits use the degradation pipeline to produce distorted variants, with five strength levels for every transformation.The level-specific PSNR and SSIM values in Tables 5 and 6 describe each transformation applied in isolation at its weakest and strongest levels.Source: E COMPLETE LIST OF POST-PROCESSING… · p. 23
• At level 5, photometric shifts can lower PSNR to 15–20 dB while SSIM remains at least 0.90, whereas shot noise reduces SSIM to 0.13.These metrics capture complementary effects: noise, glass blur, and strong darkening degrade structure most, while neural codecs, adversarial embedding attacks, and WMForger remain at or above 29 dB and 0.85 SSIM.Source: E COMPLETE LIST OF POST-PROCESSING… · pp. 23–24

F ADDITIONAL DETECTOR RESULTS •

• Figure 8 reports REALIS-tuned detector ROC-AUC by generator, comparing each generator’s images with a pooled 160k-image real reference set across validation, test, and Expert splits.It marks training-split generators in green and proprietary generators in orange, orders columns by decreasing average AUC within each split, and averages detectors in the last row.Source: Figure 8 · p. 24

E COMPLETE LIST OF POST-PROCESSING TRANSFORMATIONS

• Because transformations are chained and followed by watermarking and downscaling, cumulative image degradation is generally greater than the isolated-transform values.The isolated values are reported for each transformation at its weakest and strongest levels.Source: E COMPLETE LIST OF POST-PROCESSING… · pp. 23–24

F ADDITIONAL DETECTOR RESULTS •

• The additional results extend the per-generator analysis to conventional detectors and zero-shot VLMs, including multiple Qwen, Gemma-4, and InternVL3.5 model variants.The conventional-detector inventory includes AIDE, BFREE, DIRE, DRCT, FatFormer, and other listed detectors; the VLM inventory also includes Qwen2.5-VL.Source: F ADDITIONAL DETECTOR RESULTS • · p. 24

F.1 PER-GENERATOR RESULTS

• 0.867 on Val and 0.859 on Test versus 0.754 for open-source and 0.744 for proprietary Expert generators: mean AUC is lower on Expert.Training-used generators are not consistently easier to detect than held-out ones; Expert generator averages range from 0.86 for SD-3.5 Large-Turbo to 0.64 for Kandinsky-5.Source: §F.1 · p. 24
• 0.79 to 0.60: distortion lowers mean AUC across detector–generator cells, with the largest losses on the easiest clean generators and the smallest on Kandinsky-5.The easiest-to-hardest generator gap halves from 0.31 to 0.16; 82% of cells decrease and 24% of distorted cells fall below 0.5.Source: §F.1 · p. 24, Figure 9 · p. 25

F.2 DETECTION AT A FIXED OPERATING THRESHOLD

• 44.7%: mean recall at the 0.5 threshold on Expert, versus 72.1% on Val and 69.3% on Test, while mean real-image FPR is 16% in every split.LASTED has pooled Expert AUC 0.81 but recall of only 12%; detector FPRs vary widely, from below 1% for DMID, AIDE, and LASTED to 41–59% for MASKSIM and EFFORT.Source: §F.2 · p. 26, Figure 10 · p. 26
• 0.51: mean calibrated F1 on Expert, versus 0.73 on Val and 0.71 on Test; detector rankings differ from AUC rankings (Expert Spearman correlation 0.35).DMID has the highest Expert AUC (0.92) but fifth-highest F1 (0.63), while UFD leads F1 (0.70); F1 is computed with real and generated classes weighted equally and should be read with FPR.Source: §F.2 · p. 26, Figure 11 · p. 26

G ADDITIONAL ANALYSES BY IMAGE CHARACTERISTICS

• Performance analysis bins six per-image statistics and reports pooled and generator-balanced AUC, real-image FPR, and generator-balanced FNR at threshold 0.5.The statistics include noise variance, high-frequency energy, colorfulness, and object count.Source: Figure 12 · p. 27

G.1 GENERATOR-BALANCED STATISTICAL SWEEPS

• Generator-balanced AUC weights generators equally within each bin, countering changes in generator mixture across statistic bins.Quantile bins are computed jointly on real and generated images, and each AUC uses a real reference from the same bin.Source: §G.1 · p. 27
• 8–13% of pooled AUC spread remains after balancing for noise variance, high-frequency energy, and aesthetics, although aesthetic-related errors still shift.Overall AUC rises from 0.73 to 0.81 for noise variance and 0.74 to 0.80 for high-frequency energy, while balanced ranges are 0.774–0.781 and 0.778–0.786. For aesthetics, the overall range of 0.72–0.79 shrinks to 0.76–0.77, but FPR rises from 8.8% to 16.0% and FNR falls from 58.4% to 45.0%.Source: §G.1 · p. 27
• 0.767 to 0.804 generator-balanced AUC accompanies rising object count, with fewer false positives and nearly unchanged false-negative rates; colorfulness is weaker and non-monotone.For object count, FPR falls from 12.2% to 9.2% while FNR stays near 51%. Colorfulness AUC is 0.769 in the least colorful quintile and 0.773 in the most colorful, versus 0.785–0.789 in intermediate quintiles; FPR increases in the most colorful bin.Source: §G.1 · p. 27
• 0.808 balanced AUC occurs for aspect ratios in [1.35, 1.5), but that bin lacks Kandinsky 5 and therefore averages six generators rather than seven.Without Kandinsky 5, the peak disappears and balanced AUC is 0.800–0.814 in all bins. Balancing cannot compensate for absent generators, so geometry associations depend on the output sizes each generator supports; the other five statistics have at least 140 images per generator in every bin.Source: §G.1 · pp. 27–28

Generator profiles

• Figures 13 and 14 profile generators on all 8.39M images generated before filtering, using the resolution and inference settings of the pipeline rather than identical settings across architectures.Figure 14 standardizes each statistic across generator means and clips values at ±2.5; its colors compare generators within each row, not quality.Source: §G.2 · p. 28, Figure 14 · p. 29

Prompt-matched quality

• HiDream-I1-Full wins 79.5% of HPSv3, 85.2% of PickScore, and 77.0% of ImageReward comparisons, while SD-1.4, SD-1.5, SD-2.1, and YOSO-PixArt-1024 win at most 27%.Each pairwise comparison uses common prompts, about 13k per pair.Source: §G.2 · p. 28
• Mean win rates averaged across three metrics rise from 42.7% for training generators to 55.5% for validation, 59.3% for test, and 67.8% for the seven open-source Expert generators.This pattern is consistent with assigning generators to splits by generation quality.Source: §G.2 · p. 28
• Preference-based quality does not directly predict detection difficulty: Kandinsky-5 ranks fourth of seven at 67.9% but has AUC 0.61, while HiDream-I1-Full ranks first at 77.0% and has AUC 0.83.SD-3.5 Large-Turbo has a 54.0% win rate and is easiest to detect, with category-averaged AUC 0.93.Source: §G.2 · pp. 28–29

Generator profiles

• Across generators, mean win rate correlates 0.92 with photorealism and 0.93–0.95 with prompt relevance and semantic coherence, but more weakly with detected objects (0.78) and faces (0.64).Aesthetic and complexity scores correlate −0.04 and −0.07 with win rate; the two YOSO-PixArt models, ranked 29th and 32nd of 35 by win rate, have the highest mean LAION aesthetic.Source: §G.2 · p. 29
• The reconstruction filter removes 67% of YOSO-PixArt-1024 images, versus at most 35% for any other generator, because the filter removes images reconstructed unusually well by the autoencoder.SD-1.4, SD-1.5, and SD-2.1 combine the lowest VLM ratings and smallest outputs with high-frequency energy 2.0 to 3.0 standard deviations above the generator average.Source: §G.2 · p. 29

H POST-PROCESSING SENSITIVITY BY TRANSFORMATION AND STRENGTH

• Expert-split analyses use real and seven open-source-generator images, average generator-versus-real AUCs equally, and compare clean and distorted AUC on identical images.Figure 15 uses 14 reference detectors, while Figure 16 includes all 50 paired detectors; intervals are pointwise 95% and conditional on the chosen samples and detectors.Source: H POST-PROCESSING SENSITIVITY BY… · p. 29
• Mixed recompression, glass blur, and shot noise yield the lowest mean distorted AUCs, while tone-curve, linear-contrast, and brightness changes yield smaller losses.Glass blur is more damaging than Gaussian or motion blur, and shot noise more damaging than Gaussian or multiplicative noise; overlapping subsets can include additional transformations.Source: H POST-PROCESSING SENSITIVITY BY… · pp. 29–30, Figure 15 · p. 32
• Blur and JPEG compression show pronounced increases in matched AUC loss with strength, while color changes are flatter and less monotonic, and repeated compression remains highly damaging across levels.Geometry losses increase with strength for VLMs but change relatively little for off-the-shelf detectors; nominal levels are operation-specific, and different points can reflect different images and co-occurring transformations.Source: H POST-PROCESSING SENSITIVITY BY… · p. 30, Figure 16 · p. 33
• About 0.84 mean pooled ROC-AUC on clean images falls to 0.71 at the lowest pipeline setting and approximately 0.68 at the highest in a separate validation sample.The strongest setting retains roughly half the clean AUC margin above chance, but has incomplete prediction coverage, so endpoints are available-case trends rather than fully matched comparisons.Source: H POST-PROCESSING SENSITIVITY BY… · p. 30, Figure 17 · p. 33