Overfitting: An Unexpected Asset in AI‐Generated Image Detection

We would like to sincerely thank the reviewer for taking the time to review our manuscript! In response to the 6 questions raised by the reviewer, we provide the following explanations in turn:

Q.1: In line 196, the authors believe that ε follows a Gaussian distribution, I wonder whether there is a reasonable explanation.

Thanks for pointing out this potentially confusing explanation. $\hat{\epsilon}$ represents the vector that minimizes the inner product with the gradient of $L$ in image space under the $\ell_2$ norm constraint (as shown in Equation 4). The choice of $\hat{\epsilon}$ is specific to $L$, which is related to the design of our network, specifically to the implementation of the functions $w$ and $\theta$. Conceptually, $\epsilon$ points from the sample $x$ towards a nearby minimum of $L$. Finding this value is challenging, so we resort to random sampling near $x$ in an attempt to cover this minimum. A practical approach to this is random sampling from a normal distribution, which is why we model $\epsilon$ as Gaussian noise.

When using noise sampled from a uniform or laplace distribution, comparable results are obtained. Under the experimental setup in Table 1, the average AUROC/AP performance is as follows:

In response to your valuable question, we will add the above explanations, results, and discussions to the revision.

Q.2: Meanwhile, I believe that when ε is designed to be sampled from a Gaussian distribution, the proposed approach will suffer from performance degradation when Gaussian blur is applied to images, as the added noise ε’ and the designed ε belong to the same distribution, resulting in an increase in L(x+ε’). I hope the authors can clarify some of the points.

A.2: We agree with your point. Moreover, our experimental results shown in panels (b) and (c) of Figure 2 provides similar conclusions, where Gaussian blur or Gaussian noise is applied to the images during the testing phase. Namely, for all tested detection methods, performance degrades in the presence of such adversarial perturbations. We would like to highlight that our method demonstrates more robust detection performance. We will highlight the results and conclusions in our revision.

Q.3: The AUROC and AP metrics are insensitive to classification thresholds. Based on this, they may not fully reflect the generalization ability of the model. I hope the authors can provide more experimental results, such as the AUROC and AP on real samples of LSUN-Bedroom (Table 3) and generated samples from ImageNet settings (Table 1), or the Accuracy with fixed thresholds on different datasets.

Thanks for your constructive suggestion. Below, we present the AUC/AP results for the real-swapped datasets from Tables 1 and 3, r for real and f for fake. The results obtained are comparable with the original setup, demonstrating the robustness of our method. In comparison, the experimental group that includes ImageNet (real) exhibits a slightly higher proportion of better performance, which may be attributed to the fact that our convolutional layers were trained on ImageNet.

The following presents the test set accuracy performance using the optimal average accuracy threshold obtained from the validation set.

Q.4: Why is g(x) designed as multiple trainable convolutional layers? Would other architectures, such as U-Net, yield better or worse results?

A.4: The use of two convolutional layers in $g_\theta(x)$ is intended to provide a lightweight transformation. The first layer captures basic patterns and edges, while the second layer refines these features. This refined output is then added to the original image with a small coefficient, allowing for subtle adjustments to the input image without significantly altering its structure. This design ensures that the transformed output remains close to the original image, which is essential for preserving the integrity of DINOv2's feature extraction while allowing for minor perturbations.

Furthermore, due to the small coefficient of the transformation, the desired effect is achieved with this lightweight structure alone. In the experiment, using wider networks with the same architecture does not lead to performance improvement (Table 7); instead, it increases the training cost. When more advanced architectures, such as U-Net, are employed, a similar performance is also observed:

Thanks again for your insightful question. We will add the results and discussions to the revision.

Q.5: Will the selection of the training dataset affect the detection performance?

A.5: Using real-world image datasets with richer scenes and content tends to yield better results. The results presented in the paper reflect the performance of the network trained on ImageNet. When we used the LSUN-bedroom dataset, we observed relatively worse performance. To ensure fairness, we present the experimental results for both settings on the LAION-Sora detection task.

When we use datasets with a limited range of scenes, the convolutional layers in our trained network may capture more specialized scene information, rather than generalizable features from real-world images.

Q.6: Can you evaluate the complexity of the proposed DetGO?

A.6: Compared to the Transformer backbone used in DINOv2, the complexity of our lightweight, trainable convolutional layers is minimal. Additionally, we use a dual-model structure when evaluating a single image, so our method requires two forward passes for detection. The complexity of a single model is evaluated as follows: 77.82G FLOPs, 302.91M parameters.

Thank you for your rebuttal, which addresses most of my concerns. However, I still have some questions. The author does not seem to have discussed that the proposed method has poor robustness to Gaussian noise. Meanwhile, I wonder if the classification of the method depends on the level of Gaussian noise, for example, when real images are added with stronger noise while fake images are weaker, will the method make a misjudgment?

The author does not seem to have discussed that the proposed method has poor robustness to Gaussian noise.

Thank you for raising this point. We acknowledge that our method is not robust to Gaussian noise, as it leads to performance degradation, likely because the added noise $\epsilon$ and the designed noise belong to the same distribution, resulting in an increase in $L(x+\epsilon)$. We will further highlight this observation in the revised manuscript. However, as shown in Figure 2(c), we would like to emphasize that our method demonstrates relatively superior performance under such perturbations.

I wonder if the classification of the method depends on the level of Gaussian noise, for example, when real images are added with stronger noise while fake images are weaker, will the method make a misjudgment?

Regarding your question about the impact of differing noise levels between real and fake images, this is an insightful observation. We conducted additional experiments to analyze the impact of applying stronger noise levels to real images while keeping the noise levels in generated images fixed. Specifically, we applied Gaussian noise with a fixed intensity (noise(f)=0.05) to generated images and varying higher intensities (noise(r)) to real images. The results are as follows:

Adding stronger noise to real images brings their distribution closer to that of generated images, making it more challenging for the detector to distinguish between them. We will include these results in the revised manuscript, as we believe they will further strengthen our study.

I increase my score to 6 since the authors have address some of my concerns, with additional experimental results.

Q.3: More generally, this paper does not discuss the key question: how to trade off the generalization power to unseen real images and unseen AI-generated images.

A.3: We agree that we do not provide sufficient theoretical grounds to calculate a definitive optimal perturbation size. While the theoretical reasoning behind the optimal noise level remains unclear, we propose a strategy of optimizing the noise strength through experimentation. To find the optimal noise level, we test a range of noise intensities and evaluate their performance, aiming to identify the best balance point that neither overfits the training set nor fails to effectively recognize generated images. We deeply agree that a theoretical fundation is crucial for a new framework, thus we would like to leave it as our future work.

Q.4: The authors have not mentioned how to select the threshold, as depicted in Figure 1.

A.4: Thanks for pointing out this potentially confusing configuration.

• First, we only used the accuracy metric in Table 2, as detailed in the response to Q.5. In practice, we could consider selecting a user-preferred threshold based on user's preference.

• Second, for all the rest experiments, we follow previous works and evaluate performance using AUROC and AP, where both metrics are threshold-free.

In response to your valuable comments, we will add the above explanations to the revision.

Q.5: In Section 4.1, the authors claimed to evaluate the accuracy (ACC). However, the reviewer cannot find any ACC results. AUC and AP are both threshold-independent evaluation metrics, according to previous works. A high value of AUC or AP does not necessarily imply a high value of accuracy. Additionally, considering the previous issue, the threshold of loss is likely to have a significant impact on the accuracy.

A.5: We sincerely appreciate your careful review. In response, we will add the following descriptions to the revision. We only used the accuracy (ACC) metric in Table 2 because the dataset and some baseline performances in Table 2 are directly taken from [2]. To facilitate comparison, we adopted the same metric, ACC, as used in [2]. Additionally, we noticed that the description of Table 2 in the experimental section is unclear and contains errors. We will address and correct these issues in the revision.

For tasks similar to ours, AUROC and AP are more commonly used evaluation metrics. Since both AUROC and AP do not require the selection of a threshold, they provide a more consistent and objective comparison. As a supplementary measure, we also present our ACC performance, with the experimental setup identical to that in Table 1. The threshold is the optimal threshold of the validation set.

Q.6: The authors do not describe how they use the generative models to generate the test data and how much data are used.

A.6: Thanks for your kind reminder. We will highlight the following descriptions in the revision. As stated in Section 4.1, the test datasets we used are primarily from [1] and [2], rather than being re-generated. Correspondingly, our training dataset is sourced from [1], and the details are as follows.

Training dataset: ImageNet, sourced from [1], containing 100,000 images, with 100 images per class.

Test dataset:

1. Sourced from [1], with each dataset containing 50,000 images.

• IMAGENET classes (Table 1): ImageNet, ADM, ADMG, BigGAN, DiT-XL-2, GigaGAN, LDM, StyleGAN-XL, RQ-Transformer, Mask-GIT.

• LSUN-bedroom classes (Table 3): LSUN-bedroom, ADM, DDPM, iDDPM, StyleGAN, Diffusion-Projected GAN, Projected GAN, Unleashing Transformers.

2. Test dataset from [2] (Table 2): Each dataset contains 6,000 images.

• Midjourney, ADM, GLIDE, Wukong, VQDM, BigGAN

3. Other (Table 4): Sora: 5,000 images, LAION: 5,000 images.

[1] Exposing flaws of generative model evaluation metrics and their unfair treatment of diffusion models

[2] Genimage: A million-scale benchmark for detecting ai-generated image

Q.7: As mentioned in Section 5, access to high-quality training data may have a large impact on performance. The authors should at least explore such impact by showing the results as a function of the number of training images.

A.7: Thanks for your kind suggestion. We would like to highlight that using real-world image datasets with richer scenes and content tends to yield better results. Thus, we explore the relation between the number of training images and detection performance. The results are given in Figure 4, where the x-axis represents the number of forward passes. The reported results are the averages from multiple experiments with randomly sampled data. Since the number of training parameters is relatively small, our network converges quickly.

The results presented in the paper reflect the performance of the network trained on ImageNet. Inspired by your valuable comments, we also conduct additional experiments using the LSUN-bedroom dataset. To ensure fairness, we present the experimental results for both settings on the LAION-Sora detection task. We observed relatively worse performance, but our method still outperforms baseline methods.

In response to your valuable comments, we will add the above results and discussions to the revision.

We would like to sincerely thank the reviewer for taking the time to carefully review our manuscript. In response to the 7 weaknesses identified by the reviewer, we provide the following explanations in turn:

Q.1: The largest weakness is that conventional OOD detection methods are not discussed and compared. As the reviewer understands, the authors have formulated the problem of AI-generated image detection as a typical OOD detection process, where the outlier is also normally not exposed to the detector. Therefore, the authors should acknowledge this similarity and test conventional OOD detection methods before proposing a new method. For example, a well-trained model itself can be used to detect OOD samples, here the AI-generated images, based on their output confidence. This also corresponds to the second limitation described in Section 5.

A.1: Thanks for your constructive comments and suggestions.

• First, we present a comparison of "AUROC/AP" between DetGO and typical OOD detection methods, with the experimental setup identical to that in Table 1. We selected the classical MSP algorithm and, for fairness, replaced the backbone with DINOv2, using the classification head pre-trained on ImageNet provided by the official repository. The second comparison algorithm, MCM, is based on the CLIP backbone.

Traditional OOD detectors primarily focus on the semantic information of images, which makes it challenging for them to distinguish between ID images and generated images that are semantically similar to ID images.

• Second, we agree that we should discuss more OOD detection methods, as we mentioned related methodologies in our work. Thus, we will add a subsection to the revision to provide discussions for related OOD detection works.

Thanks again for your valuable comments, we will add the above results, discussions, and related works to the revision.

Q.2: The underlying assumption that the proposed method can work is that the $\epsilon$ can represent the nature of AI-generated images. However, the authors just simply adopt the Gaussian noise, without any discussion of possible alternatives and impact. More generally, the $\epsilon$ can be treated as a special type of universal fake image, and therefore, it is important to discuss its properties on the final detection performance. In particular, there may exist one perfect type of $\epsilon$ that can generalize to most kinds of unseen fake images.

A.2: Thanks for your in-depth comments. $\hat{\epsilon}$ represents the vector that minimizes the inner product with the gradient of $L$ in image space under the $\ell_2$ norm constraint (as shown in Equation 4). The choice of $\hat{\epsilon}$ is specific to $L$, which is related to the design of our network, specifically to the implementation forms of the functions $w$ and $\theta$. Conceptually, $\epsilon$ points from the sample $x$ towards the nearby minimum of $L$. Solving for this value is difficult, so we instead resort to random sampling around $x$ in an attempt to cover this minimum. A practical approach to this is to use random sampling from a normal distribution, which is why we model $\epsilon$ as Gaussian noise.

When we use noise sampled from a uniform or laplace distribution, comparable results are obtained. Under the experimental setup in Table 1, the average AUROC/AP performance is as follows:

Dear reviewer #RbxC,

Thank you for your positive feedback and for increasing the score. We are glad that the additional experimental results addressed your concerns. If there are any remaining issues or suggestions for improvement, we would be happy to address them further.

Best regards and thanks,

Authors of #8988

Q.3:The design change is essentially learning the representation similarity between the original and perturbed images on the DinoV2 representation space. However, the Backbone (DinoV2) and the noise distribution (Gaussian) used are too similar to the existing work RIGID. However, the method does not use it as a baseline.

A.3: We agree that both our method, DetGO, and RIGID operate in the representation space of pre-trained models and leverage perturbations. Please let us clarify the underlying philosophies and implementations diverge in critical ways.

• DetGO’s approach is centered on leveraging the phenomenon of overfitting to a specific distribution (natural images), which is distinctly different from RIGID's objective of representation similarity in a perturbation-robust space.

• DetGO introduces a novel dual-model structure—an anchor model and an overfitting model—which creates a controlled sharp minimum. This novel dual-model setup is designed to highlight loss divergences between real and generated images, providing a detection framework focused on distributional mismatch rather than invariant representation similarity, as seen in RIGID.

• Inspired by your insightfyl comments, we believe RIGID is a strong baseline of our method. Thus, we provide a comparison of the AUROC between DetGO and RIGID, with the experimental setup identical to that in Table 1.

Although our method achieves slight performance gain, RIGID is a training-free approach. Thus, we will highlight the above results and disucssions in our revision.

The selection of DINOv2 as the backbone, and the use of Gaussian perturbations, are strategic to our method’s goals rather than a replication of RIGID. We chose DINOv2 for its robust, invariant feature extraction and its capacity to distinguish distributional differences between real and generated images—a key factor in DetGO's overfitting-based detection. Our application of these perturbations is tuned to exploit training-time sensitivity rather than test-time resistance to them. We acknowledge that a direct comparison with RIGID could add value, and we will address this in future revisions.

Q. 4:The performance of Ojha in Table 1 and Table 3 is lower than its reported performance, please give the implementation details of the baseline methods.

For the Ojha baseline, we use the official code repository and the official checkpoint provided. However, the dataset we utilized differs from the one used for training the checkpoint provided by Ojha. As mentioned in lines 244-246, we employed the dataset from [1], where the images are converted to PNG format with a resolution of 256x256, which may have led to subtle differences in the image distribution. Additionally, the details of the generative model usage may also differ from Ojha's approach, and these factors together likely contributed to the observed decline in detection performance.

[1] Exposing flaws of generative model evaluation metrics and their unfair treatment of diffusion models

We would like to sincerely thank the reviewer for taking the time to carefully read and evaluate our manuscript! In response to the insightful questions raised by the reviewer, we provide the following explanations in turn:

Q.1: what is the intuition for using a DinoV2 as a backbone? Why not use some other self-supervised model?

A.1: Here, we present a comparison of the AUROC between the backbones DINOv2 and CLIP, with the experimental setup identical to that in Table 1. As discussed in reference [1], DINOv2 is a state-of-the-art self-supervised model that demonstrates a more global perspective across a wide range of visual tasks. It provides high-quality, stable feature representations, maintaining significant feature stability even under various transformations.

Q.2: How is $\epsilon$ sampled from the Gaussian distribution? What are the parameters of this distribution? How is $\rho$ chosen? The justification for using two convolutional layers in $g_\theta(x)$ is weak. More explanation is needed.

A.2.1: Selection of $\rho$, Sampling of $\epsilon$ from the Gaussian Distribution:

The parameter $\rho$ acts as a bound on the norm of $\epsilon$. Under this constraint, we can obtain the optimal solution for the perturbation according to Equation (4). As stated in lines 193-197, solving for this solution is challenging, so we resort to using a Gaussian distribution as a substitute. The primary reason for starting with Gaussian noise is its simplicity and broad applicability, as it allows for the creation of small, controllable perturbations across the entire image space. We set the mean of the noise to 0 and the standard deviation to $\lambda_n$ to control the amplitude of the noise, thereby replacing the role of $\rho$. The effect of varying the parameter $\lambda_n$ is discussed in Table 9.

Inspired by your valuable question, we considered different types of noise forms, including uniform noise and Laplace noise, which exhibit performance similar to that of Gaussian noise.

A.2.2: Justification for Two Convolutional Layers in $g_\theta(x)$:

The use of two convolutional layers in $g_\theta(x)$ is intended to provide a lightweight transformation. The first layer captures basic patterns and edges, while the second layer refines these features. This refined output is then added to the original image with a small coefficient, allowing for subtle adjustments to the input image without significantly altering its structure. This design ensures that the transformed output remains close to the original image, which is essential for preserving the integrity of DINOv2's feature extraction while allowing for minor perturbations.

Furthermore, due to the small coefficient of the transformation, we achieve the desired effect with this lightweight structure alone. Employing a larger network or simply increasing the dimensionality of intermediate layers (Table 7) would not enhance performance and would instead increase computational cost. We also experimented with more advanced network architectures, such as U-Net, which yielded similar performance.

[1] Exposing flaws of generative model evaluation metrics and their unfair treatment of diffusion models

Dear Reviewer #Z8iN,

Thank you very much for your time and valuable comments.

We understand you have a busy schedule, but as the deadline for discussion period is approaching, could you kindly review our response and let us know if you have any further questions? We would be happy to provide additional clarifications or make further revisions as needed.

Best regards,

Authors of #8988

Dear Reviewer #Z8iN,

We sincerely appreciate the time and effort you have dedicated to reviewing our work.

If there are any outstanding questions or issues that require clarification, please do not hesitate to reach out. We would be more than happy to address them promptly.

Thank you once again for your invaluable support and contributions to improving our manuscript. Your feedback is greatly appreciated.

Best regards,

Authors of #8988

Dear Reviewer #Z8iN,

We greatly value the insightful feedback you have provided on our manuscript. We would kindly ask if you might have the opportunity to review our responses at your earliest convenience.

Your input has been instrumental in improving our work, and we remain committed to addressing any additional concerns or suggestions you may have. Please let us know if further clarifications or adjustments are required, we are more than willing to assist.

Thank you once again for your valuable time and effort.

Best regards,

Authors of #8988

Dear Reviewer #Z8iN,

We sincerely appreciate the insightful feedback you have provided on our manuscript! We would like to kindly ask if you could review our responses at your earliest convenience and let us know if there are any areas that need further improvement.

Your feedback is of great importance to enhancing our work. If any additional clarifications or revisions are required, we are more than willing to assist promptly.

Thank you once again for your time and support!

Best regards,

Authors of #8988

Dear Reviewer #Z8iN,

As the discussion period deadline approaches, we wanted to kindly follow up regarding your feedback on our manuscript.

Your insights have been invaluable, and we would greatly appreciate it if you could review our responses at your earliest convenience. Should you have any further questions or suggestions, we remain at your disposal to address them promptly.

Thank you again for your time and dedication.

Best regards,

Authors of #8988

Dear Reviewer #Z8iN,

Thank you again for your time and insightful comments on our manuscript. We truly understand how busy your schedule must be. However, as the discussion window is nearing its end, we kindly ask if you could take some time to review our responses.

Your feedback is greatly valued, and we are eager to address any additional suggestions or concerns you may have to further improve our work.

Best regards,
Authors of #8988

We sincerely appreciate the reviewer’s detailed feedback. Below, we address the two points raised:

1. Selection of DinoV2 as the Backbone
   DinoV2 was chosen for its strong representation-learning capabilities, particularly its ability to handle diverse image distributions effectively. While empirical results support this choice, we recognize that a more detailed theoretical rationale would be valuable and plan to explore this in future work.

2. Backbone Sensitivity and Performance Degradation
   We acknowledge the backbone sensitivity of our method, as reflected in the performance drop when replacing DinoV2. However, we identified that the previous response "PART 1" contained underestimated experimental results, which have now been corrected and updated:

   	DetGO-DINOv2	DetGO-CLIP	DetGO-DINO
   AUC	83.06	79.26	77.53

   Reducing backbone sensitivity and improving generalization across models will be key directions for future research.

Thank you for your constructive suggestions, which are invaluable for improving our work. We will address these issues more comprehensively in future iterations.

Dear Reviewer #Z8iN,

If your schedule permits, we would be deeply grateful if you could kindly confirm whether our responses have adequately addressed your concerns. Your input is extremely important to us, and we remain committed to making further improvements if needed.

Thank you once again for your thoughtful review and support.

Best regards,
Authors of #8988