FerretNet: Efficient Synthetic Image Detection via Local Pixel Dependencies

Dear Reviewer,

Thank you for your detailed review. While we appreciate the time you have invested, we must respectfully state that we believe your overall negative assessment is based on several fundamental misunderstandings of our paper's content and a misinterpretation of our experimental results. We have identified numerous claims in your review that are factually inconsistent with the information presented in our manuscript.

We will address each of your points below, providing direct references to the paper to correct these inaccuracies.

1. Clarifications on Factual Misunderstandings in the Review

A significant portion of the negative evaluation stems from claims that are directly contradicted by the text of our paper.

• Regarding W6 & Q2 (Missing Training Loss): You state that the training loss function is not specified. This is incorrect. As clearly stated on Page 6, Line 216, "Binary Cross Entropy with Logits Loss (BCEWithLogitsLoss) is adopted as the loss function." The entire training setup, including the optimizer, learning rate, and data augmentation, is detailed in Section 5.2 (Lines 212-217).

• Regarding Q4 (Source of Synthetic-Aesthetic Dataset): You ask for the source of this dataset. This information is explicitly provided. On Page 6, Lines 205-209, we state that the images were "sampled from the Simulacra Aesthetic Captions (SAC) dataset" and the real images were from "LAION-Aesthetics V2".

• Regarding Q1 (Even vs. Odd Pixels): You claim we state the model "performs better when the number of pixels is even," which you find counter-intuitive. This is a significant misreading of our text. We never make this claim. On Page 4, Lines 140-142, we state our zero-masking strategy is "particularly beneficial when the neighborhood contains an even number of pixels." This refers to the number of neighboring pixels used for the median calculation (e.g., a 3x3 window has 8 neighbors after excluding the center—an even number), not the window size itself. This standard practice ensures the median is always an actual pixel value from the neighborhood, enhancing statistical robustness.

• Regarding W5 (MRF Justification): You claim we do not explain the applicability of the MRF assumption. This is the very foundation of our method, explained in Section 4.1. On Page 4, Lines 133-135, we state: "According to the Markov Random Field (MRF) assumption, the probability distribution of a pixel depends only on its local neighborhood." We then immediately provide the mathematical formulation (Equation 2) and build our entire LPD feature (Equation 5) upon this principle. The method itself is the justification for its applicability.

• Regarding Q3 (Inclusion of VAEs): Your question about VAEs highlights a key trend in generative AI. While we mention VAEs in our introduction to provide historical context, their primary role in the current state-of-the-art is not as standalone generators due to limitations in output fidelity. Instead, VAEs are now a critical component within Latent Diffusion Models (LDMs), where they function as powerful encoders and decoders for the latent space. Therefore, our mention of VAEs serves to trace the developmental lineage of generative techniques, acknowledging that the LDMs we extensively evaluate are fundamentally built upon them. Our evaluation correctly focuses on the final generative models (GANs, LDMs) as per established benchmarks.

2. Rebuttal of Methodological and Experimental Criticisms

• Regarding W8 & W9 (Performance vs. SOTA): Your claim that our results are "not competitive" and improvements are "marginal" is a severe mischaracterization of the evidence presented.

  • Efficiency vs. Accuracy Trade-off: You state that FatFormer outperforms FerretNet in Table 1. You fail to mention the colossal difference in model size, which is a central point of our paper. As shown in Table 4 (Page 8), FatFormer has 577.3M parameters, while our FerretNet has only 1.1M (~0.2% of the size) and runs ~8.7x faster. Achieving competitive accuracy (95.9% vs. 98.4%) with a model that is 500 times smaller and vastly more efficient is a significant achievement, not a weakness.
  • Superiority on Diffusion Models: You call the improvement in Table 2 "marginal." We respectfully disagree. Our FerretNet outperforms the SOTA FatFormer (96.9% vs 95.0% ACC). Defeating a model 500x its size on the most recent and relevant class of generative models is a clear and significant contribution, directly contradicting your assessment.

• Regarding W10 (Utility of the Synthetic-Pop Dataset): You argue that because our method exceeds 98% accuracy, the dataset is "not challenging." This logic is flawed. The utility of a benchmark is to differentiate methods. As shown in Table 3 (Page 7), on our Synthetic-Pop dataset, our method achieves 98.3% ACC, while existing SOTA methods like FatFormer and NPR fail dramatically, scoring only 70.5% and 77.4% respectively. This does not show the dataset is easy; it proves the exact opposite. It demonstrates that modern, high-quality generators pose a significant challenge to existing detectors, and it is precisely this challenge that our method successfully overcomes. The dataset is therefore highly valuable to the community.

• Regarding W1, W2, W7 (Dataset Details, Related Work, and Missing Models):

  • (W1) Key details of Synthetic-Pop are provided in Lines 199-204. We state the 6 models used, the source of captions and real images, and the total size. We commit to releasing the dataset with full documentation.
  • (W2) A deep review of foundational models is beyond the scope of a paper focused on a novel detection method. Our related work section correctly focuses on synthetic image detection literature, which is standard practice.
  • (W7) Thank you for pointing this out. FLUX is indeed a significant and very recent model. We did consider its inclusion during the construction of our Synthetic-Pop benchmark. Unfortunately, at the time of our experiments, we encountered significant technical challenges in deploying the model in a way that would ensure a stable and fair comparison, a common issue with novel, complex architectures upon their initial release. We therefore proceeded with a set of six other highly popular, diverse, and representative text-to-image models that form a strong and challenging basis for evaluation. We are actively working to integrate it and will certainly include it in future iterations of our work.

• Regarding W3 & W4 (Clarity and Justification of Section 3): Section 3 provides a high-level, unifying conceptual framework to motivate our search for common artifacts (latent space deviations and decoding inconsistencies). It is not intended as a rigorous mathematical proof of equivalence, but as an accessible intuition for why a universal detector might be possible. This framing is a valid and common rhetorical tool in scientific papers. Figure 1 serves as a standard visual aid for this two-stage process.

---

In summary, we believe this review contains critical factual errors and misinterpretations that led to an unfounded negative conclusion. Our paper introduces a lightweight, efficient, and novel method grounded in statistical principles. It demonstrably outperforms the state-of-the-art on modern diffusion models and on a new challenging benchmark, all while being over 500 times smaller. We have provided comprehensive experiments and ablations that you yourself have acknowledged as a strength (S1). We kindly ask the Area Chair to consider these points and re-evaluate the validity of this review.

Dear Reviewer,

Thank you for your valuable feedback. We are pleased that you found our paper easy to follow and our method efficient. Your questions regarding post-processing robustness, novelty, and adaptive attacks are critical, and we are pleased to provide new experimental results and clarifications below.

1. Regarding Robustness to Common Post-Processing

This is a critical point, as real-world images are rarely pristine. We fully agree and, as per your suggestion, have conducted a comprehensive robustness analysis on the ForenSynths test set against three of the most common post-processing operations: JPEG compression, image resizing, and rotation. The detailed ACC/AP results are as follows.

A note on the image resizing experiment: For this test, we adopted a more stringent and realistic evaluation protocol. Instead of resizing all images to a fixed input size, as is common for batch processing, we fed the arbitrarily resized images (with dynamic resolutions) directly into the models. As FatFormer's architecture does not support dynamic resolutions, it was excluded from this specific test.

Analysis of Results:

• JPEG Compression: As expected, heavy JPEG compression (Q=75) severely degrades artifact signals, causing a significant performance drop across all methods. We note that lightweight methods without large-scale pre-training (including our FerretNet) are more affected than FatFormer, which likely learned features more robust to compression from its massive pre-training dataset. This highlights a common challenge for all lightweight detectors.
• Image Resizing: In this more challenging dynamic-resolution test, our FerretNet demonstrates strong robustness, outperforming other lightweight methods in both down-sampling and up-sampling scenarios. This indicates that our method is not sensitive to scale changes.
• Image Rotation: In the rotation robustness test, FerretNet achieves the best performance among all methods, even significantly surpassing the heavyweight FatFormer. This result provides strong evidence for the superiority of our design: LPD features are based on local, orientation-agnostic statistical dependencies, not on fixed spatial or frequency patterns, making them inherently immune to geometric transformations like rotation.

We thank you for your valuable suggestion. This analysis is crucial for evaluating the practical potential of our method, and we commit to including the full experimental details and the table in the appendix of the final version for readers' reference.

2. Regarding Novelty: From "Locality" to "Statistical Anomaly"

We understand your concern regarding the novelty of the "locality" concept. We wish to clarify that our core innovation is not simply "using local cues," but how we fundamentally model "locality."

Many prior works rely on detecting specific, heuristic-based local artifacts, such as checkerboard patterns from GANs or specific frequency anomalies. This approach is akin to "pattern matching" and can lose effectiveness as generator models evolve and artifact patterns change.

Our approach is philosophically different, shifting the detection paradigm from "pattern matching" to "statistical anomaly detection":

• A Principled Statistical Foundation: Our LPD feature is built on a cornerstone of natural image statistics—the Markov Random Field (MRF) assumption. We do not hunt for any known artifact "signatures." Instead, we measure the degree to which an image violates the local pixel statistical dependencies that should exist in a natural scene.
• A Model-Agnostic Artifact Signal: This method provides a model-agnostic and more universal artifact signal. Whether an artifact is caused by unnatural smoothness from a generator's decoder or an abrupt change from a diffusion denoising step, it will leave a trace at the local statistical level that LPD can capture.

We believe this principled, universally applicable artifact modeling approach based on statistical foundations represents a substantive contribution, not merely an incremental extension of locality-based ideas.

3. Conceptual Differences with NPR

This is an excellent question that helps to precisely position our work. The difference can be summarized with an analogy:

• NPR looks for the "tool marks." It focuses on detecting the fixed, high-frequency patterns, like "fingerprints," left in an image by specific upsampling operations (e.g., nearest-neighbor interpolation). Its logic is: "I found traces left by Tool A, therefore this image is a forgery."

• LPD checks if the "scene obeys the laws of physics." It does not care what "tool" was used. It checks if the final result is statistically plausible. Its logic is: "The distribution of pixels in this local region does not follow the statistical laws of the natural world, therefore it is a forgery." Whether the artifact was caused by upsampling, diffusion denoising, or some other unknown technique, LPD can detect the anomaly as long as it disrupts natural local statistics.

In short, NPR is fingerprinting a specific cause, while LPD is detecting a universal effect.

4. Regarding the Threat of Adaptive Attacks

This is a very forward-thinking question. An adaptive attack, where a generator is trained to explicitly fool a detector, is the ultimate test of robustness.

• The Generator's Dilemma: While an attacker could theoretically add "minimizing LPD artifacts" as a loss term during training, this would place them in a dilemma. To completely eliminate LPD artifacts, the generator would need to perfectly replicate the extremely complex local statistics of natural images at the pixel level. This is an incredibly difficult optimization problem in itself. Forcing the model to do this would likely act as strong regularization that could harm the overall image quality, diversity, or semantic coherence of the generated images. The attacker must make a difficult trade-off between "undetectability" and "image fidelity."

• Raising the Bar for Attackers: Our method essentially raises the bar for attacks. An attacker can no longer get away with patching a few superficial, specific artifacts; they must now solve a much more fundamental and difficult problem of statistical simulation.

• Future Work: We completely agree that this is a vital research direction. As a defense, we plan to explore and enhance our model's robustness in future work by incorporating LPD as part of a discriminator in an adversarial training loop.

Dear Reviewer,

Thank you for your constructive feedback and for appreciating the simplicity, effectiveness, and well-designed ablation studies of our work. Your insightful questions have helped us to further probe the core principles of our method and clarify our contributions. We are pleased to provide the following responses and new experimental results.

1. Clarifying the Architectural Contribution of FerretNet

Thank you for this insightful question, which gives us the opportunity to precisely define our architectural contribution.

• Clarifying our Contribution: We agree that the general concept of multi-branch architectures for expanding receptive fields, such as in GoogLeNet, is well-established. The key novelty of FerretNet, therefore, lies not in inventing the multi-branch paradigm itself, but in the principled and highly-specialized architectural engineering for a unique task: detecting subtle artifacts from LPD feature maps. Our contribution is a demonstration of how a carefully co-designed set of lightweight components (depthwise separable, grouped, and dilated convolutions) can create an extremely efficient yet powerful feature extractor for this specific type of low-level signal—a problem for which, as we show, standard deep networks are ill-suited.

• New Experiment on Scaling FerretNet: To directly address your insightful question, "if you make FerretNet larger (e.g., 20x larger), if the performance will get better or worse," we conducted a new set of experiments by scaling our model up and down. We report the average results across the ForenSynths, Diffusion-6-cls, Synthetic-Pop, and Synthetic-Aesthetic test sets.

• Analysis and Conclusion: These results provide a clear answer and strongly support your intuition.
  • Making the model significantly larger (FerretNet-L, ~20x parameters) results in a slight performance degradation.
  • This confirms your hypothesis that overfitting is the primary reason why deeper, larger networks like Xception/ResNet50 (and even a bloated FerretNet-L) perform worse. Our detection task relies on identifying subtle, low-level, local statistical artifacts present in the LPD maps. These maps are more akin to residual signals than semantic images.
  • Large, deep networks are designed to learn high-level semantic features. When applied to LPD maps, they are prone to overfitting to spurious correlations or specific artifact patterns from the training generator (ProGAN), which ultimately harms their generalization ability to unseen artifacts. Our proposed FerretNet-B hits the "sweet spot," being sufficiently expressive to capture the necessary features without having the excess capacity that leads to overfitting.

We will incorporate this new ablation study and the accompanying analysis into the final version of the paper, as it provides a much stronger justification for our lightweight design.

2. Clarifying the Connection Between Section 3 (Artifact Analysis) and Section 4 (Method)

Thank you for pointing out the need for a clearer link between these two sections. We apologize if the connection was not sufficiently explicit. The logical flow from our theoretical analysis to our method design is as follows:

• Section 3 (The 'Why'): This section establishes the fundamental reason why artifacts exist. We analyze how various generative models, despite their different architectures, share a common challenge: synthesizing high-frequency details from lower-dimensional information. This process inevitably leads to microscopic inconsistencies.

• Section 4.1 (The 'What'): This section proposes LPD as a tool to quantify these microscopic inconsistencies. Based on the assumption that natural images exhibit strong local pixel dependencies (a Markov Random Field property), LPD is designed to measure the breakdown of these dependencies. Thus, LPD is the direct methodological response to the problem identified in Section 3.

• Section 4.2 (The 'How'): This section designs FerretNet to effectively analyze the LPD maps generated in the previous step. As shown in our paper (e.g., Figure 2), the LPD artifacts are spatially non-uniform; their patterns and scales vary across the image. Therefore, a specialized network with multiple receptive field branches (our FerretNet) is required to capture these diverse, non-stationary artifact responses, from micro-local to meso-local scales.

In the final manuscript, we will revise the beginning of Section 4 to explicitly state this logical flow (Why -> What -> How) to ensure the motivation for our method is clear and well-connected to our analysis.

---

Once again, we sincerely thank you for your sharp and constructive feedback, which has significantly helped us strengthen the paper. We hope our response and the new experiments have addressed your concerns.

Dear Reviewer,

Thank you for your detailed and insightful review of our work. Your thoughtful comments are invaluable for improving the quality of our paper. We have carefully considered each of your points and have provided clarifications and new experimental results accordingly. We hope that our response adequately addresses your concerns.

1. Regarding Training on ProGAN and Performance on Diffusion Models (Weakness 1)

We appreciate the reviewer's focus on this point, as it touches upon the core philosophy of our work.

• Intentional Experimental Design: Our experimental setup was by design. We aimed to simulate a challenging and realistic scenario: training a lightweight model on a limited, known source of artifacts (ProGAN) to test its ability to generalize to unseen generators with entirely different artifact patterns (like diffusion models). This follows the stringent "Train on One, Test on Many" evaluation paradigm in the field of universal forgery detection, which is designed to assess a model's "zero-shot" generalization capability.

• Performance vs. Efficiency Trade-off: We acknowledge the accuracy gap with the SOTA method, FatFormer, on DALL-E. However, we wish to highlight the context and significance of our result:

  • Extreme Efficiency: Our FerretNet has only 1.1M parameters, which is approximately 0.2% of FatFormer's size (577.3M). Furthermore, our method requires no large-scale pre-training. In contrast, FatFormer is a modified version of CLIP and relies on costly pre-training on large-scale datasets.
  • Excellent Generalization: Despite this massive efficiency advantage, our model still achieves a high accuracy of 91.4% on the completely unseen DALL-E dataset, significantly outperforming most baseline methods.

Therefore, our central contribution is not to surpass the SOTA accuracy on a specific dataset but to achieve an unprecedented and exceptional balance between computational cost, deployment efficiency, and cross-generator generalization ability. This makes our method highly valuable for practical, resource-constrained applications, which we believe is a significant contribution.

2. Regarding Applicability to Non-"Latent Space-Decoder" Architectures (Question 1)

This is a very insightful question that gets to the heart of generative model diversity.

• Universality of the Core Mechanism: The "latent space + decoder" framework used in Section 3 of our paper serves as an accessible abstraction for mainstream generators. However, our core module, LPD (Latent-artifact-based Pseudocode Detection), is not fundamentally dependent on the existence of an explicit latent space. The essence of LPD is to capture local inconsistencies in the pixel domain that arise from any process of "up-sampling" or "generation." Whether it's a GAN decoding from a low-dimensional vector, a DDPM progressively denoising to create high-frequency details, or an autoregressive (AR) model making pixel-by-pixel (patch by patch) predictions, the process inevitably introduces local artifacts that do not conform to the statistical properties of natural images. LPD is designed to detect precisely these subtle, process-induced flaws.

• New Experimental Verification: To robustly demonstrate the universality of LPD, we have conducted new experiments as you suggested on two models that do not strictly follow the classic "latent space-decoder" paradigm: the AR-based model VAR [1] and a vanilla DDPM. Each test set contains 500 synthetic and 500 real images (DDPM images from DIRE [2], VAR images generated by us). We evaluated our FerretNet, trained only on ProGAN, against them. The results are as follows:

Conclusion: The results clearly show that FerretNet achieves the best performance on both AR and DDPM models, even significantly outperforming the heavyweight FatFormer. This strongly supports our claim that the local pixel-domain inconsistencies captured by LPD are a more fundamental and universal type of artifact feature, which generalizes exceptionally well to unseen generators with diverse artifact patterns. We will add this experiment and a corresponding analysis to the final version of our paper.
[1] Visual autoregressive modeling: Scalable image generation via next-scale prediction, NeurIPS 2024.
[2] Dire for diffusion-generated image detection, CVPR 2023.

3. Regarding LPD Interpretability and Visualization (Weakness 2 & Question 2, 3)

We wholeheartedly agree that enhancing interpretability is crucial for understanding our method.

• The "Signature" of LPD Artifacts: As the reviewer astutely observed, LPD does reveal a distinct artifact "signature." As shown in Figure 2 of our main paper:

  • The LPD maps of real images typically present as uniform, low-energy, noise-like textures, reflecting the local smoothness and consistency of natural scenes.
  • The LPD maps of synthetic images expose high-energy, structural artifacts, such as bright lines, grids, or patches, especially along object edges, on smooth surfaces (like skin), or in complex textures. These are the unnatural traces left by the generative model as it "invents" details.

• Commitment to Add Visualization Analysis in Final Version: To more intuitively demonstrate how LPD influences the final decision and to address your concerns about decision boundaries and misclassifications, we commit to adding a new, dedicated section for visualization analysis in the appendix of the camera-ready version. This section will include:

  • Typical successful cases: Side-by-side comparisons of real/fake image patches, their corresponding LPD maps, and heatmaps to clearly showcase the artifact "signatures."
  • Decision boundary cases: Examples where the artifact signals in the LPD maps are weak, making them challenging for the model.
  • Failure case analysis: Examples of false positives (real images misclassified, perhaps due to strong natural periodic patterns) and false negatives (undetected fakes, perhaps with very subtle artifacts) to provide a deeper insight into the limitations of our method.

We believe these additions will greatly enhance the paper's interpretability and completeness.

4. Regarding Unaligned Comparison Methods (Weakness 3)

We understand the reviewer's concern about the fairness of comparisons. We would like to clarify that our comparison strategy strictly adheres to established and recognized evaluation benchmarks and protocols within the field.

• Following Established Protocols: As mentioned in Section 5.1.1, our experimental setup follows the protocols established in prior works.
• Evolution of Benchmarks: The benchmarks ForenSynths, Diffusion-6-cls, and Synthetic-Pop were introduced at different times to evaluate the then state-of-the-art (SOTA) or most representative methods. For instance, when FatFormer was evaluated for its generalization to diffusion models, it was compared against methods like DIRE and Ojha et al. on the Diffusion-6-cls benchmark. Therefore, our use of these same comparison methods on each benchmark is a standard academic practice to ensure direct and fair comparability with those foundational works.
• Improving Clarity: To make this rationale clearer to readers, we will add a sentence in the experimental section of the final version to explicitly explain the basis for selecting comparison methods for each benchmark.

5. Regarding Missing Citations (Weakness 4)

Thank you very much for pointing out these highly relevant and recent papers! We have carefully reviewed them.

• Commitment to Update: We will incorporate a detailed discussion of these four papers [1-4] in the "Related Work" section of the final version, analyzing their connections and differences with our work.
• Regarding Experimental Comparison: Given the limited rebuttal period, a full and fair reproduction and comparison against these very recent methods is not feasible. However, we commit to checking for publicly available code for these methods while preparing the camera-ready version. If feasible, we will do our best to include them in our benchmark tests to provide an even more comprehensive evaluation.

6. Regarding Other Issues (Societal Impact and Table Format)

• Societal Impact: Thank you for the reminder. We will add a "Broader Impact / Limitations" section in the final manuscript. We will state that while our work aims to be defensive, any detection method can potentially be used by attackers to evaluate the "undetectability" of their models, thus contributing to a technological "arms race."
• Table Format: We apologize for the reduced readability of Tables 1 and 2, which were transposed due to page limitations. In the final version, we will prioritize readability and make every effort to reformat these tables to be more intuitive.

Dear Reviewer,

Thank you for your follow-up and insightful feedback. We have addressed your remaining points with new analysis and experiments, and outline our revision plan below.

1. Regarding Interpretability: How the Network Interprets LPD Maps

You raised an excellent and much deeper point, prompting us to refine our analysis of how the network makes its decisions. Our goal is to provide an interpretation that is fully consistent with our method's proven high generalization capability.

• Revisiting the Core Hypothesis: Our method's high accuracy across 22 diverse generators proves that the combination of LPD and FerretNet learns a highly generalizable representation of artifacts, not just ProGAN-specific patterns.

• A More Scientific Analysis of Failure Cases: The failure cases do not contradict this general success but instead help define the boundaries of our model's decision-making.

  • False Positive Case (The Real Rock Formation): The natural geological strata in this real image create large-scale, regular patterns. Our LPD module correctly flags these as statistically unusual. The network, having learned that strong, structured statistical deviations are a primary indicator of artificiality, misclassifies it. This demonstrates the model's high sensitivity, but also reveals its limitation when faced with rare, real-world scenes that are themselves highly structured "outliers."

  • False Negative Case (The Synthetic Cows): In the synthetic image of cows, the LPD map correctly highlights widespread, high-energy artifacts. The failure is not one of feature detection but of decision thresholding. The network aggregates all detected artifact signals to produce a final "fakeness" score. In this specific case, despite numerous detected artifacts, their combined weighted sum did not push the final score over the threshold required for a "fake" classification. This is a rare instance where a state-of-the-art generator produced an image that sits precisely on the "real" side of our model's learned decision boundary.

• Key Insight and Conclusion: These failures are best understood as rare edge cases. Our method's strength is its robust statistical analysis; its limitation is that this model, like any, has a decision threshold that can be narrowly missed by hyper-realistic fakes or wrongly triggered by statistically extreme real images. This analysis reinforces, rather than contradicts, our core claim of high generalizability.

• Our Plan for Revision: We will incorporate this more consistent and scientifically sound analysis into the appendix, complete with visual examples.

2. Regarding Performance, Generalization, and Comprehensive Comparisons

• Clarification on Fair Comparison Methodology: You asked critical questions about our comparison. To ensure the fairest and most rigorous comparison possible, we have standardized our evaluation protocol:

  1. Unified Training Data: All ** methods**, including our own, were trained or fine-tuned on the same limited ProGAN 4-class dataset. For the CO-SPY model, we use their official checkpoints trained on the larger ProGAN 20-class and SD-v1.4 datasets.
  2. Unified Parameter Calculation: In the same spirit, we have unified the parameter calculation method for all models in the table below. You may note a difference in FatFormer's parameter count compared to our main text for this reason, as this table ensures a true apples-to-apples comparison of model size.

  We will make these protocols explicit in our final manuscript.

• Comprehensive Comparison Table: Following your suggestion, we expanded our comparisons to include the methods you mentioned.

• Our Plan for Revision: We will integrate this more comprehensive table and our clarified methodology into the paper.

---

• Thank you again for your feedback. We have worked diligently to address your points. We welcome the opportunity to clarify any remaining concerns that might prevent a more positive assessment of our work.

References:

[1] CO-SPY: Combining Semantic and Pixel Features to Detect Synthetic Images by AI, CVPR 2025.
[2] Improving Synthetic Image Detection Towards Generalization: An Image Transformation Perspective, KDD 2025.