Preprint 2 Mentions
Towards Universal Fake Image Detectors that Generalize Across Generative Models
Utkarsh Ojha2023
Yuheng LiYong‐Jae Lee
Average · 50th Percentile
7 citations · Computer Vision and Pattern Recognition
Open Access

TLDR

A tool trained to spot one kind of computer-made picture often mistakes newer kinds for real. Using broad visual knowledge instead of memorizing one maker’s flaws helps it recognize many different kinds of computer-made pictures.

Summary

1 Study Aim

The authors investigate whether fake-image detectors can recognize images made by generative models (systems that create images) from families absent during training. They test the hypothesis that real-versus-fake classification (deciding whether an image came from a camera or generator) fails because detectors memorize narrow fake-image patterns. The study proposes using general image features instead of features trained specifically for this decision. Detectors should learn broad visual clues rather than memorize one generator’s particular flaws.

2 Study Design

The study trains baseline detectors with 720,000 images from ProGAN, a generative adversarial network (GAN, a system that creates images through competing neural networks), across 20 LSUN object categories. The proposed methods use a frozen CLIP-ViT-L/14 vision-language model (trained to connect images with text) and its 768-dimensional feature space. Nearest-neighbor classification compares a test image with stored real and fake examples. Linear probing trains only a small final classifier. The researchers test both methods across GANs, diffusion models, and DALL-E, an autoregressive generator, using average precision and classification accuracy. They also vary training sources, dataset sizes, network backbones, and image compression or blur. The researchers compare simple feature matching against trained detectors across many image-making systems.

3 Findings

The study reveals that a detector trained on ProGAN fakes identifies many GAN variants but labels almost all unseen diffusion fakes as real. This happens because the real class becomes a sink class, meaning a catch-all for images lacking familiar fake patterns. With frozen CLIP features, nearest neighbors reach 82–84% accuracy on unseen diffusion and autoregressive models. Linear probing reaches about 82% accuracy and 95 mAP, or mean average precision measuring ranking quality. These methods improve roughly 23–26 percentage points in accuracy and 15–19 mAP over the strongest baseline. Training on diffusion images also detects GAN images well. Performance remains fairly stable with much less data and after blur or JPEG compression. The authors recommend these methods as strong generalization baselines, while the shared fake-image signal remains unexplained. Using broad visual information makes fake-picture detection work much better across unfamiliar image-making systems.

Abstract

With generative models proliferating at a rapid rate, there is a growing need for general purpose fake image detectors. In this work, we first show that the existing paradigm, which consists of training a deep network for real-vs-fake classification, fails to detect fake images from newer breeds of generative models when trained to detect GAN fake images. Upon analysis, we find that the resulting classifier is asymmetrically tuned to detect patterns that make an image fake. The real class becomes a sink class holding anything that is not fake, including generated images from models not accessible during training. Building upon this discovery, we propose to perform real-vs-fake classification without learning; i.e., using a feature space not explicitly trained to distinguish real from fake images. We use nearest neighbor and linear probing as instantiations of this idea. When given access to the feature space of a large pretrained vision-language model, the very simple baseline of nearest neighbor classification has surprisingly good generalization ability in detecting fake images from a wide variety of generative models; e.g., it improves upon the SoTA by +15.07 mAP and +25.90% acc when tested on unseen diffusion and autoregressive models.

Referenced In