STD-FD: Spatio-Temporal Distribution Fitting Deviation for AIGC Forgery Identification

We appreciate your recognition of our method's novelty and effectiveness. Below are our responses to your Questions (Q) and Weaknesses (W):

W: Addressing targeted attacks against diffusion sampling mechanics would strengthen real-world applicability claims.

Thank you for your insightful feedback. Following the same experimental settings described in the "Influence of Adversarial Attacks" section, we conducted additional experiments specifically focusing on adversarial perturbations during the diffusion sampling process. Concretely, adversarial noise (with L2-norm strengths of [0.01, 0.03, 0.05]) was injected at each timestep of the reverse diffusion process (20 steps in total). Experimental results are summarized below (AUC,%):

Under these adversarial conditions, the performance fluctuates within approximately 2.5%, demonstrating that the STD-FD identification mechanism remains robust against targeted sampling attacks.

Q1: How do the parameters of superpixel segmentation (e.g., the number of blocks K) affect performance?

Thank you for this constructive question. We performed an ablation study varying the number of superpixel blocks Kfrom the baseline setting K=10. The performance variation across different K values is within approximately 1.08%, as summarized below (AUC,%):

It's noteworthy that selecting a larger value of K does not always yield better results. Superpixel methods inherently suggest an optimal clustering number based on image content. In facial forgery scenario, the recommended K≈10 ensures effective semantic consistency; significantly deviating from this value negatively affects pixel-level semantic coherence and impairs spatio-temporal decoupling during diffusion sampling.

Q2: What is the training overhead (GPU usage and training time) of the method?

Thank you for your question. STD-FD involves diffusion sampling, DFactor construction, and downstream classification during training. The peak GPU memory usage during training is approximately 18.8GB. With a batch size of 32, the average training time per epoch is approximately 3 minutes 30 seconds (tested on NVIDIA A40 GPU with Intel Silver 4310 CPU).

Q3: Ethical Review

Sorry for the confusion. As stated in our Impact Statement, our research strictly targets deepfake detection, aiming to mitigate potential risks posed by generative AI technologies. We do not facilitate unethical use; rather, our work enhances reliability and security in detecting AI-generated content. Therefore, we respectfully submit that our research aligns with standard ethical guidelines.

Thank you for recognizing our work. Below are our responses to your questions (Q).

Q1: Methodological Coupling & DFactor Universality

Sorry for the misunderstanding. Reconstruction-based approaches rely on the magnitude of reconstruction error to distinguish real from fake images. When the reconstruction model encounters data from an unfamiliar domain, its robustness deteriorates. Our method instead uses a diffusion model to map images into a latent space, from which we extract their temporal variations.

To illustrate, consider a simplified scenario in which 5 and 80 represent pixel values from two distinct domains. Reconstruction-based methods attempt to reconstruct them (e.g., 5 → 4.9 and 80 → 70), leading to large errors when dealing with domain shifts (e.g., transitioning from cat to human, or from a diffusion-generated fake to a GAN-generated fake). In contrast, our approach tracks the feature variation over time, such as: 1 → 2 → 3 → 4 → 4.9 and 50 → 55 → 60 → 65 → 70. Although the numerical values differ greatly, both sequences share a similar variation trend (akin to a slope in mathematics or acceleration in physics). Based on this observation, we design a spatio-temporal distribution modeling framework centered on DFactor, thereby decoupling from semantic content.

To clarify this principle, we visualized the average temporal changes of 256 pixels for cross-domain forgery data projected into latent space. The results show (Following the guidelines of this rebuttal, visualizations can be seen on anonymous website https://anonymous.4open.science/r/STDFD_re/README.md , if interested) :

• Significant Differences between Real and Fake Data: Real images exhibit irregular, larger-scale changes due to the absence of fixed generative constraints, whereas forgeries conform to specific generative paradigms (GAN/diffusion/autoregressive) and have smaller, more uniform variation patterns.

• Consistent Trends across Different Subjects and Architectures: Whether it’s a cat vs. a person, or a GAN vs. diffusion vs. autoregressive model, the amplitude of temporal change remains similar. This amplitude (or trend) is precisely what motivates our design of DFactor.

Furthermore, the sampler we use was pretrained on general content, making it adept at lower-level semantic reconstruction. This capability facilitates an effective mapping of images into the latent space for our approach.

Q2: Superpixel Effectiveness

Qualitative: The superpixel algorithm segments images into semantically coherent regions based on similarities in color, texture, and pixel-level low-level features. For example, human figures and backgrounds naturally form distinct semantic regions. Superpixel-based segmentation effectively decouples their individual temporal variation patterns during sampling. A detailed analysis and illustration of this benefit can be found in Appendix B (see Figure 7).

Quantitative: Experiments comparing superpixel and patch-based methods confirm improved performance. Superpixels outperform the patch-based and no-segmentation baselines by +2.04% and +3.15%. Detailed experimental results on the 12 forgery subsets are provided on anonymous link ( https://anonymous.4open.science/r/STDFD_re/README.md , if interested).

Q3: Generalization Capability

Qualitative: Please refer to Q1.

Quantitative: STD-FD achieves SOTA detection performance across two benchmarks involving GAN-based (DF-GAN, BGAN) and autoregressive-based models (DALLE series), supporting its general applicability.

Q4: Mitigating Model-Target Mismatch

Please refer to Q1.

Q5: Diffusion Model Interchangeability

Thanks for this practical question. Due to computational efficiency and sampling quality, we primarily use DDIM. To validate robustness, we compared DDIM with alternative sampling methods (DDPM, DPM-Solver, and Progressive Distillation):

Thank you very much for your detailed review and constructive comments. We sincerely appreciate your recognition of the innovation and thoroughness of our work. Below are our responses to your Questions (Q) and Weaknesses (W):

Q1|W1: Is the essence of the distribution fitting bias the temporal variation in noise distribution, or is it an implicit constraint of the generative model itself? Can the authors provide further clarification?

We apologize for any confusion. The essence of the distribution fitting bias lies in the temporal variations of noise distributions. Although DDIM employs a diffusion-based architecture, we use intermediate DDIM timesteps solely to extract spatio-temporal distribution information inherent in real and forged data, rather than fitting specifically to a particular network architecture. Our experimental results provide strong evidence across two benchmarks, effectively detecting forgeries generated from different architectures, including DF-GAN and BigGAN (GAN-based) as well as the DALLE series (autoregressive-based).

Q2|W2: A formal or axiomatic definition of DFactor should be used to delineate its core principles, further separating conceptual essence from specific implementations.

Thank you for your valuable suggestion. We will include a formalized, abstract definition of DFactor in the final version to provide a clear conceptual paradigm beneficial to the research community.

Formally, the definition of DFactor is as follows:

DFactor represents a feature vector derived from diffusion-based spatio-temporal decoupling, characterizing the variation patterns of specific categories. Specifically, DFactor partitions spatio-temporal information into K distinct classes based on feature similarity. Within each class, DFactor encodes variation patterns across superpixel regions during sampling. Consequently, these K classes of DFactors constitute a feature pattern library. For downstream classification tasks, relevant vectors obtained via identical spatio-temporal decoupling processes can be matched against this library to achieve precise classification.

These principles can be formalized by the following equation: $\mathcal{L} = -g\left(S_1(\text{DFactor}_1, \mathcal{T}_1)\, S_2(\text{DFactor}_2, \mathcal{T}_2)\,\dots\,S_K(\text{DFactor}_K, \mathcal{T}_K)\right)$

• $\mathcal{L}$ quantifies the dissimilarity among samples across K categories with respect to their DFactors.
• $S_i(\text{DFactor}_i, \mathcal{T}_i)$ represents the set of distances related to a specific class $\mathcal{T}_i$.
• The function $g(\cdot)$ takes K finite sets as input and outputs a scalar value indicating the overall dissimilarity among these sets.

Q3: Corrections of writing

Thank you for your careful reading and valuable feedback. We will carefully correct these writing issues in the final version.

Thank you for acknowledging our work. However, there is a significant misunderstanding: we do not use intermediate steps from the forgery generation architecture (Model A). Instead, we employ a general diffusion model (Model B) to obtain its intermediate process. Without knowing the specific architecture used for generating fake images, we map the images into a latent space and model the spatio-temporal distribution based on that latent temporal information. Below are responses to your questions (Q) and weaknesses (W):

Q1/W1: Clarification on Task Definition

Apologize for any ambiguity. Our work focuses on binary image authenticity detection by disentangling spatio-temporal distribution differences between real and synthetic images. This is achieved through analyzing time-step noise patterns via DDIM sampling (unrelated to forgery generation).

Q2/W2: Assumption on Intermediate Diffusion Information & Experimental Fairness

Sorry for the misunderstanding. We clarify that no assumptions are made regarding access to original generative models (Model A). Instead, our framework uses publicly available DDIM sampling (Model B) to capture temporal noise dynamics. As illustrated in Figure 1a, STD-FD integrates the sampling process natively, ensuring practical applicability. The acquisition of intermediate diffusion features constitutes our key innovation rather than an unfair experimental advantage.

Q3/W3: Alternative Methods & Complexity

Sorry for the confusion.

a) Upon initially discovering the importance of temporal sampling differences, we indeed experimented with simpler alternatives. Initial experiments with 3D-Xception and ViT achieved 87.48% and 88.01% AUC on DeepFaceGen – comparable to SOTA but below our method. The key improvement is the careful decoupling of temporal discrepancies, inspiring the fine-grained design of our STD-FD approach centered around the DFactor module.

b) STD-FD requires 272ms (2253MiB) per image (Line 761), comparable to Xception (253ms/2090MiB) and EfficientNet (241ms/1985MiB).

Q4/W4: Superpixel vs. Patch-based

Thanks for your question.

Qualitative: Superpixel segments images into regions with similar color, texture, and low-level features, producing blocks more consistent with pixel-level semantics than uniform grid partitioning. Such spatial processing is essential for effectively decoupling temporal noise maps. For example, superpixel segmentation can distinguish distinct temporal variation patterns between human subjects and backgrounds, as detailed in Appendix B (Figure 7 for a specific case analysis).

Quantitative: Our ablation study demonstrates that superpixels outperform the patch-based and no-segmentation baselines by +2.04% and +3.15% AUC, respectively. Detailed experimental results on the 12 forgery subsets, following the guidelines of this rebuttal, are provided on an anonymous link (if interested: https://anonymous.4open.science/r/STDFD/README.md ).

Q5/W5: a) Experiments with different sampling conditions; b) Sampling steps; c) Sampling methods

Appreciate your advice.

a) Yes, Influence of sampling steps (line 416) show improved detection performance with increasing timesteps (from T=5 to 50). Notably, even at T=5, the AUC surpassed 90%, outperforming SOTA. This underscores the efficacy of modeling forgery traces via spatio-temporal distributions.

b) Please see a).

c) We incorporated additional sampling methods, including DDPM, DPM-Solver, and Progressive Distillation. Experiments followed the identical setup used in the influence of sampling steps study (line 416):

• Reverse process of DDPM involves a stochastic Markov chain with randomness at each step. With limited steps, noise errors accumulate significantly, reducing the quality and efficiency of spatio-temporal features compared to deterministic methods (ideal results require around 1000 steps).
• DPM-Solver reformulates diffusion sampling as solving an ODE using higher-order solvers, providing excellent image reconstruction quality in just 20 steps. Although high-quality outputs and superior FID scores are achieved, computational overhead inevitably increases due to the higher-order ODE solution.
• Progressive Distillation (PD) utilizes pretrained DDIM as teacher model, training a student model to mimic the teacher’s performance in fewer steps. Although sampling times significantly decrease, a performance drop of 1.5% is observed due to changing the optimization objective.

W6: Equation Corrections

Thanks for meticulous review. We will rectify all notation inconsistencies in the final version.