Dual Data Alignment Makes AI-Generated Image Detector Easier Generalizable

Thank you for acknowledging strong gneralization and efficiency of our proposed DDA. We will alleviate your remaining concerns.

---

Q1: Regarding the first point, I have two main concerns. First, it is unclear whether the authors apply the DCT transform at the original image resolution or in 8×8 blocks—this is not explicitly specified in the paper. Second, the authors appear to define the high-frequency region as a bottom-right rectangle in the DCT space. However, DCT coefficients increase in frequency in a zigzag pattern from the top-left to the bottom-right. As such, this rectangular selection might omit some high-frequency components, making the design potentially suboptimal.

Thank you for your pointting that concern.

• DCT Resolution: We clarify that the DCT transform in our method is applied in 8×8 blocks, consistent with the standard JPEG compression pipeline. This design reflects a practical consideration: real images in most datasets (e.g., GenImage, ForenSynth) are JPEG-compressed, while many synthetic images are stored in PNG format. Applying block-wise DCT allows us to more effectively capture and mitigate compression-related frequency biases.

• High-Frequency Region Selection: Below we conduct additional experiments using a zigzag-pattern-based frequency selection. As shown in Table 1 below, DDA with $T_{\text{freq}} = 0.2$ (zigzag) achieves a comparable performance to $T_{\text{freq}} = 0.5$ (rectangular). This suggests that our method is robust to the precise frequency indexing scheme. We will clarify both the DCT resolution and the frequency selection strategy in the revised manuscript.

Table 1. Ablation study of DDA using zigzag-based vs. rectangular high-frequency region selection.

---

Q2: For the second point, while mixup is a well-established technique in image classification, it has not been applied in AIGI detection before, so I acknowledge this as a valid contribution. However, in Fig. 9(c), the ablation results show that even when rpixel=0 or rpixel=1, the detector still achieves high accuracy. This is counterintuitive—could the authors clarify why extreme values still perform well?

Thank you again for your careful reading and constructive feedback. We apologize for the confusion caused by the x-axis notation in Fig. 9 (c). The label should be $R_{\text{pixel}}$, consistent with the figure caption. Specifically:

• $R_{\text{pixel}} = 0.0$ means no pixel-level mixup is applied (i.e., frequency alignment only).
• $R_{\text{pixel}} = 1.0$ means the pixel-level mixup ratio $r_{\text{pixel}}$ is sampled from a uniform distribution $U[0, 1]$ during training (see Eq 3 of main paper).

The strong performance at $R_{\text{pixel}} = 0$ is not contradictory. It reflects the fact that frequency-domain alignment alone is already highly effective—achieving 91% accuracy in our ablation—since VAE reconstructions provide substantial low-level alignment. Similarly, the strong performance at $R_{\text{pixel}} = 1.0$ aligns with expectations. We will correct the axis label in Fig. 9 and add this clarification in the revision.

---

Q3: The detector is fine-tuned using DINOv2 with an input size of 336×336. It would be helpful for the authors to include ablations on different commonly used backbones (e.g., CLIP, ResNet-50) and input sizes (e.g., 224×224), since most baselines are trained under these settings. Also, any justification for selecting DINOv2 as the backbone would be appreciated.

A Thank you for your comment. We clarify that we have already provided ablation studies on both input sizes (Appendix Table 6) and backbone architectures (Appendix Table 7).

• Input Sizes: Table 2 presents results for input resolutions of 224, 252, 280, 336, 392, 448, and 504. The results show that DDA remains consistently effective across all tested resolutions.

• Backbones: Table 3 compares DINOv2 and CLIP ViT-B/16. We observe that DINOv2 outperforms CLIP, likely due to its stronger focus on low-level, pixel-sensitive features that are more effective for capturing DDA-aligned artifacts. In contrast, CLIP is optimized for high-level semantics. We also attempted to train DDA with ResNet-50, but it failed to converge—likely due to insufficient representational capacity for modeling subtle DDA-induced artifacts.

Table 2. Ablation study of DDA across different input sizes.

Table 3. Ablation study of DDA across different backbones.

---

Q4: The proposed method appears to be model-agnostic. Can the authors demonstrate whether DDA-aligned data could also enhance performance when used to train other existing detection methods?

Thanks for your insightful comment. To assess whether DDA-aligned data benefits existing detection models, we conducted additional experiments that isolate the effect of DDA. Specifically, we replaced the synthetic training images in baseline methods with DDA-aligned counterparts, while keeping all other components—including model architecture, training settings, and loss functions—unchanged. The results, summarized in Table 4, show consistent and significant improvements in accuracy, confirming that DDA-aligned data enhances generalization

Table 4. Evluation of baseline methods with and without DDA-aligned synthetic data.

I have read the author's response, and most of the concerns have been addressed. The only remaining concern is the issue raised in Q1 regarding High-Frequency Region Selection. Although the rectangular-0.5 setting shows performance similar to the zigzag method, this choice is not theoretically convincing, as it does not align with the high-frequency distribution of the DCT and may miss some compressed high-frequency components.

I hope the authors will provide a more in-depth discussion or revise the corresponding method in the revised version. Compared to the overall contribution of this paper, this minor concern does not overshadow its merits. I am willing to update my rating to accept after discussion. Good luck!

We are grateful for your positive recognition of our novelty, extensive experiments and writing! We will alleviate your remaining concerns.

---

Q1: The main hypothesis of the paper (dataset bias is the problem and that the data alignment helps) is not verified in isolation. Although extensive experimental results show strong performance of the proposed method, the strong performance cannot be solely attributed to the use of the data alignment pipeline. There are several differences between the proposed method and existing approaches other than the use of DDA. For example, the original source of data used in this paper is different from those used in competitive methods. How would existing methods' performance change if DDA was used to minimize the training dataset bias?

Thank you for this thoughtful question.

We respectfully clarify that, in line with established evaluation practices, we use the official checkpoints released by the original authors for baseline methods—a standard protocol also followed in prior works such as FatFormer, C2P-CLIP, AIDE, and DRCT—ensuring consistency and fairness in comparison.

To directly address your concern, we conduct a controlled one-to-one comparison, where we adopt the same architecture, training strategy, and real image source as the competitive method, but replace its synthetic images of its training set with DDA-aligned images. This setup isolates the impact of DDA while keeping all other factors constant. Preliminary results show clear performance improvements.

Table 1. Controlled one-to-one comparison of existing methods with and without DDA-aligned training data. Each baseline method (UnivFD, FatFormer, DRCT) is retrained under identical settings, replacing only the original synthetic training data with DDA-aligned samples. DDA consistently improves performance across all datasets.

Q2: The paper does not report threshold-less metrics such as AP or AUROC which are commonly used in many published papers in this area. Threshold-less metrics are important measures of the separability between the representation of real vs AI-generated samples.

Thank you for this thoughtful suggestion regarding threshold-independent evaluation metrics. We clarify that, in line with prior works such as C2P-CLIP, DRCT, AlignedForensics, and AIDE, our main paper reports balanced accuracy for comparability. Following your suggestion, we have additionally computed AP and AUROC scores for our method. Our method DDA achieves state-of-the-art performance, with average scores of 0.964(AP) and 0.967(AUROC)—outperforming all baselines by a non-trivial margin. These results confirm the superior performance of DDA.

Table 2. Overall Comparison of AP / AUROC. Bold numbers indicate the best score per row; values in parentheses denote the absolute improvement over the original method.

Q3: The mechanism for choosing a decision threshold is not discussed in the paper.

Thank you for pointing this out. We clarify that our DDA-based binary classifier uses a fixed decision threshold of 0.5: samples with predicted logits greater than 0.5 are classified as synthetic, and those below as real. No threshold tuning or calibration is applied during evaluation.

Dear Reviewer,

Thank you again for your valuable efforts and constructive advice in reviewing our paper. As the discussion period nears its end, we look forward to your feedback on our responses. We have made every effort to address all your concerns and are happy to clarify any points or discuss any remaining questions.

Best regards,

Authors

We appreciate your positive comments on our novelty, extensive experiments and writing! We will alleviate your remaining concerns.

---

Q1: The biases in format, content, and size can be mitigated through data augmentation or by expanding the dataset, without the need for reconstruction.

Thank you for raising this important concern.

Content and size bias: reconstruction-based methods able to generate aligned synthetic counterparts, preserving content while altering only generation-specific characteristics. in contrast, dataset expansion cannot guarantee precise semantic alignment in every detail (e.g., object types, textures, and layouts), leaving content bias unaddressed.

On the complexity of reconstruction-based approaches: We respectfully disagree that reconstruction-based methods are overly complex. With modern frameworks (e.g., diffusers), VAE reconstruction is accessible and computationally lightweight. Table 10 of our main paper shows DDA is more efficient than many existing baselines in terms of generation time.

Format bias: Due to the asymmetric encoding in real vs. synthetic training images (JPEG-compressed real vs. PNG synthetic), JPEG augmentation can result in double-compressed real images versus single-compressed synthetic images. Consequently, models may learn to associate stronger compression artifacts with authenticity. We empirically substantiate this in Tables 1 and 2:

• Table 1 shows that VAE reconstruction + JPEG augmentation exhibits a significant drop (↓22.0) when tested on JPEG-format synthetic images, indicating format bias. In contrast, DDA maintains stable performance (↑3.0).

• Table 2 evaluates the frequency-based detector SAFE. Even with JPEG augmentation, SAFE suffers a a significant drop (↓21.0) in accuracy on JPEG-format images. This highlights that augmentation-only methods fail to completely eliminate format bias.

Table 1. Evaluation of JPEG compression augmentation for mitigating format bias. VAE reconstruction with JPEG compression augmentation (VAE Rec. + JPEG Aug) versus VAE reconstruction with our proposed Dual Data Alignment (VAE Rec. + DDA). We report accuracies on detecting PNG-format and JPEG-format synthetic images on GenImage.

Table 2. Evaluation of format bias mitigation for SAFE.

---

Q2: Unclear whether the proposed method and the baselines in Table 3/4/5/6 were trained under the same conditions.

Thank you for raising this important concern.

Clarification on training conditions: We respectfully clarify that for the comparisons in Tables 3–6, we follow established practices by using the official checkpoints released by the original authors for all baseline methods. This evaluation protocol is also adopted in prior work such as AIDE, and DRCT.

• Fair comparison: We acknowledge that DDA may benefit from certain training setups in Table 3. To provide a more comprehensive and balanced view, we include an extended evaluation in Appendix Table 1 (see following Table 3). DDA achieves SoTA on 9 out of 10 datasets.

• One-to-one comparisons: In Table 4 we conduct additional experiments where all training variables are held constant, and the only change is substituting the synthetic training data with DDA-aligned counterparts. These controlled results consistently show that DDA significantly enhances generalization performance, isolating the impact of our alignment strategy.

Table 3: Comprehensive evaluation of DDA against state-of-the-art detectors on 10 benchmark datasets comprising 561k images from 12 GANs, 52 diffusion models, and 2 autoregressive models, including 3 in-the-wild datasets.

Table 4. One-to-One comparisons.

---

Q3: The impact of backbone.

Thank you for this question. We respectfully point out that we have already conducted ablation studies on backbones in Appendix Table 7. Below, we provide a simplified version of the results. While DDA performs best with DINOv2, it still significantly outperforms all baseline methods when using CLIP.

Table 5. Ablation study on backbone.

---

Q4: The proposed method has not been evaluated on ForenSynths.

Thank you for raising this important concern. We respectfully clarify that DDA has been already evaluated on ForenSynth in Appendix Table 3.

We sincerely thank you for your valuable time and comments. We are encouraged by your positive comments on the significance and robust experimental validation of our work! We will alleviate your remaining concerns as follows.

---

Q1: The paper Limited Explanation of $T_{freq}$ and $R_{pixel}$ Parameter Selection and needs more information.

Thank you for the helpful suggestion. We clarify that $T_{\text{freq}}$ and $R_{\text{pixel}}$ control the degree of alignment in the frequency and pixel domains, respectively. Increasing their values enhances alignment strength, which can improve sensitivity to subtle generative artifacts. However, excessively strong alignment may shift the decision boundary too close to real images, potentially reducing true-positive accuracy. To balance this trade-off, we empirically set $T_{\text{freq}} = 0.5$ and $R_{\text{pixel}} = 0.8$, based on comprehensive validation in Figure 9 of the main paper.

---

Q2: Clarify and Substantiate the "Universal Upsampling Artifact" Claim. Question: The paper states: "We hypothesize that this artifact arises during the VAE-based decoding process". While interesting, this remains a hypothesis. What specific characteristics define this "universal upsampling artifact"? Can the authors provide more empirical evidence or theoretical reasoning to support its "universality" across diverse generative models beyond the VAE decoding stage?

Thank you for this insightful question.

• What the universal artifact is: We believe that the universal upsampling artifact stems from deterministic local correlations introduced by fixed, low-rank upsampling operations (e.g., bilinear interpolation, transposed convolution). These components, widely used in the decoders of VAEs, GANs, and diffusion models, project low-dimensional latents to high-resolution outputs. However, due to their limited representational capacity, they cannot fully capture the complexity of natural image statistics. As a result, generated images often exhibit reduced local rank and unnatural pixel dependencies—properties rarely seen in real images. These artifacts are therefore architectural in origin, rather than model-specific. Similar observations have been made in prior works such as NPR [1] and SPSL [2],

• Empirical evidence for university beyond the VAE decoding: To substantiate universality, we highlight the results in Appendix Table 1. Our DDA detector, trained only on aligned VAE-reconstructed images, achieves SoTA on 9 out of 10 benchmarks. This strong generalization suggests that the universality is not confined to a specific generation mechanism.

Table 1: Comprehensive evaluation of DDA against state-of-the-art detectors on 10 benchmark datasets totaling 561k images generated by 12 GANs, 52 diffusion models, and 2 autoregressive models, including 3 in-the-wild datasets. Generator types are indicated in parentheses (G = GAN, D = Diffusion, AR = Auto-Regressive). All detectors are evaluated using official checkpoints. To mitigate format bias, JPEG compression (quality 96) is applied to GenImage, ForenSynth, and AIGCDetectionBenchmark. "DDA (ours) + JPEG Aug" denotes training with additional random JPEG compression augmentation.

---

Q3: Address Performance on Heavily Post-Processed Images (Chameleon Dataset). Question: The paper acknowledges that "Our method performs relatively lower on FLUX... and struggles to detect images with strong post-processing artifacts, as shown in the results on the Chameleon dataset". Given that real-world scenarios often involve aggressive post-processing, how do the authors envision mitigating this limitation? Is DDA inherently sensitive to certain types of artifacts, or are there planned extensions to improve robustness in these challenging cases?

Thank you for highlighting this important concern. We address this limitation through two directions: (1) enhancing DDA's robsutness to heavily post-processing, and (2) integration DDA with vision-language models (VLMs) to incorporate semantic-level signals.

(1) Enhance DDA's robustness: While DDA’s performance declines on challenging datasets like Chameleon, it still outperforms all existing methods. Moreover, as shown in the Table 1 (referenced in our response to Q2), applying stronger data augmentations (e.g., random JPEG compression) could effectively improve robustness, enabling DDA to further achieve 81% balanced accuracy on Chameleon. To our knowledge, this marks the first detector to exceed 80% accuracy.

(2) Integration with VLM: To further enhance resilience to aggressive edits, we plan to incorporate semantic-level cues that persist through low-level corruption—such as implausible object configurations (e.g., “a person with three hands”) or physically impossible scenes. These high-level inconsistencies complement DDA’s pixel- and frequency-level modeling. In preliminary experiments, prompting Qwen2.5-VL-32B as “RealismNet, a multimodal expert who determines whether an image could be photographed in the real world without digital manipulation” allowed the model to consistently flag semantically implausible content, suggesting strong potential as a complementary detection signal.

Our future work will explore a hybrid detection framework, where a vision-language model helps localize reliable regions in the image that are less affected by post-processing. DDA can then focus on those regions to detect subtle generation artifacts. This synergy between semantic robustness and low-level generalization offers a promising path toward robust, real-world AI-generated image detection.

---

Q4: "Re-evaluate "Theory Assumptions and Proofs" Claim for Clarity.

Thank you for pointing this out. We acknowledge the misunderstanding regarding the checklist item on "Theory Assumptions and Proofs." Section 3.2 provides methodological intuition rather than formal theorems or proofs. We will revise our response to “[N/A]” to more accurately reflect the content of the paper.

---

[1] Rethinking the Up-Sampling Operations in CNN-based Generative Network for Generalizable Deepfake Detection, CVPR 2024.

[2] Spatial-Phase Shallow Learning: Rethinking Face Forgery Detection in Frequency Domain, CVPR 2021.

Dear Reviewer,

Thank you for your encouraging recognition of our work. We truly appreciate the time, effort, and thoughtful advice you have provided throughout the review process. As the discussion period comes to an end, we look forward to your reflections on our responses and are happy to further clarify any points.

Best regards,

Authors