Stay-Positive: A Case for Ignoring Real Image Features in Fake Image Detection

Further test the hypothesis from Case Study 2 by applying additional post-processing techniques and evaluating more generative models. This will strengthen the analysis derived from distribution plots, as the observed differences could also be attributed to a generalization gap

Test on other generators: We would like to clarify that the generalization gap could manifest in two ways. First, the learned patterns associated with fake images may be absent in FLUX images. Second, while some signs of fakeness may be present in FLUX images, the decision may be influenced by spurious signs of realness. We believe the latter issue should be avoided, which our work demonstrates.

The principle that relying on real features harms the detector holds true for generators beyond FLUX. We have evaluated our approach on aMUSEd (Tables 1, 2) and observed the same issue. This effect is also evident in VQDM (Table 4) and generators like DALL-E, GLIDE and ADM[1] (https://imgur.com/a/eLTN1Kv), reinforcing our claim that this is a broader limitation of existing methods, which our approach mitigates.

Post-Processing: We have tested our detector's sensitivity to JPEG compression, additive noise, and low-pass filtering. For the results please refer to the response to reviewer JDtd. However, we would like to note that PNG is a lossless compression format and does not introduce artifacts.

We hope that this serves as evidence regarding the general nature of this limitation.

However, this technique introduces a bias toward the fake distribution, potentially limiting the model’s ability to generalize across different generators.

If an image lacks signs of fakeness, our method will not classify it as fake, which we do not consider a limitation. Given training images from a specific generator, we can only learn how that generator deviates from the real distribution. Without detectable artifacts, there is insufficient evidence to classify an image as fake. Our work is the first to show that when generalizing to images from a known family of generators (Introduction, lines 12–28), existing detectors underperform because they rely on real features.

Without signs of “fakeness”, existing detectors may attempt to classify images as real based on learned patterns, but as shown in Sections 3 and 5.4, these features are mostly spurious, making the classification hypothesis unreliable despite potential success in some cases.

Appendix A.2 shows that our detectors, Corvi+ and Rajan+, trained on COCO and LSUN real/fake images, perform similarly on real images from other domains, like GTA and artworks, despite these domains being unseen during training. This confirms that our method detects fakeness patterns, not just labeling out-of-distribution images as fake, reinforcing our core claim.

Spurious Fake Features Remain

It is true that spurious fake features can remain even after our method. However, we would like to clarify that the purpose of the study is to show that the real features learned by the neural network are spurious which end up harming the detector when it comes to generalization.

Use existing benchmarks for resizing studies

We thank the reviewer for sharing the Synthbuster benchmark for the resizing study. We have tested our approach on this benchmark, using a plot similar to Fig 8 from the Synthbuster paper.

Results Link: https://imgur.com/a/SMYKgea

The results show that our method effectively mitigates Corvi's spurious association of downsampling with realness, providing evidence of the generality of our algorithm.

Compare the proposed method with more zero-shot techniques to provide a broader evaluation.

We compare our detector with large model-based detectors like UFD and ClipDet, and observe that these methods do not perform as well as fully-trained neural networks, as shown in Table 2. We also tested the latent diffusion specific zero-shot detector AEROBLADE (Ricker et al., 2024), which fails to match the performance of our detectors. Therefore, we do not believe leveraging pre-trained techniques offers advantages over our approach.

References not discussed

We would like to highlight the fact that we have discussed zero-shot methods (Related Work, line 417-428). However, we will also cite works such as ZeroFake in our final version.

References

[1] Dhariwal, P., & Nichol, A. (2021). Diffusion models beat gans on image synthesis. NeurIPS 21

In Figure 7, it appears that the Redcaps images have much higher fakeness probabilities under the Corvi with the proposed method model than under the regular Corvi model. Could the authors provide more discussion about this phenomenon?

We thank the reviewer for raising this point. In all our experiments (Sections 5.2, 5.3, and 5.4), we observe that Corvi+ performs better in detecting fake images, despite the apparent "higher probability of fakeness for real images" (further details in Appendix A.2). This issue arises from our use of the term "probability of fakeness," which we now recognize as a misleading interpretation.

Our approach removes negative weights in the final layer, meaning it does not rely on "real features." As a result, the real score (Section 3.2, lines 156–159) is always zero, preventing our method from assigning highly negative scores for a given image. Consequently, for real images, the sigmoid output is closer to 0.5 rather than 0. This does not imply that a real image is half as likely to be fake, but rather represents a logit score that helps separate real and fake distributions. We will provide additional clarification for this in our final report.

Both Corvi and Corvi+ learn the same spurious fake features, such as upsampling artifacts. However, because Corvi+ eliminates spurious correlations associated with the real distribution while retaining those linked to the fake distribution, it ultimately has fewer spurious correlations overall. This leads to better detection performance.

Related to the question above, since the proposed method retrains the last layer to focus on fake attributes, would it be a concern that spurious correlations associated with fake images might inadvertently be amplified through this process?

There is a possibility that spurious correlations associated with the fake distribution could be inadvertently amplified. However, the core goal of our work is to highlight that patterns associated with the real distribution are spurious and should not influence the decision. Ignoring these patterns improves the detector's performance, independent of the spurious features in the fake distribution.

Additionally, are there any insights or analyses of what specific types of real or fake features are learned by the detectors, e.g. by inspecting the weights, using saliency maps, or other interpretability methods, etc.?

We have identified and explained specific artifacts linked to each distribution. In Section 3, we show that compression artifacts can be associated with real images, and low-level artifacts may be spuriously linked to the real distribution due to quality differences in the training data (Section 3.2). Further evidence is provided in Section 5.3.2 (lines 372–384), where post-processing FLUX- and aMUSEd-generated images significantly improves the performance of the original Corvi detector (from 57.25 to 74.57 on FLUX) and Rajan detector (from 80.64 to 87.80 on FLUX), suggesting that post-processing removes spurious low-level features which the detector associates with the real distribution.

We also experimented with GradCAM [1], but the activation maps did not provide clear insights, so we did not discuss them in our work.

Minor Suggestions

We thank the reviewer for providing us with these minor suggestions, we will incorporate these changes in the final version.

References

1. Selvaraju, Ramprasaath R., et al. "Grad-cam: Visual explanations from deep networks via gradient-based localization." Proceedings of the IEEE international conference on computer vision. 2017.

The paper could benefit from a more detailed analysis of potential limitations or failure cases of the proposed approach
In this work, we have analyzed two limitations in detail, both related to the network's potential to learn spurious fake features. In Section 6, Fig 7, we show that our improved version of Corvi can still associate upsampling artifacts with the fake distribution. Additionally, in Appendix A.4, we explain a way in which the neural network (from stage-1 in Fig 3) could have learned to associate the absence of certain features with fake images, such as the lack of WEBP compression. We hope this clarifies the drawbacks of our work. We kindly request the reviewer to highlight any specific limitations that could be further explored, and we are happy to address them.

It would be beneficial to discuss the computational efficiency of the approach more explicitly, including additional training time and inference costs
We thank the reviewer for raising these points. First, we would like to clarify that our method re-trains the final linear layer of the original network. Therefore, there are no additional inference costs, in comparison to the original method. We also compute the additional training time of our method (Rajan setting, only second stage), for which we use a batch size of 1024 on a single NVIDIA RTX A6000 machine. For optimal performance, we conduct stage-2 (Fig 3) re-training for 15 epochs which takes an additional 4h 8m 33s. Note that stage 1 takes 42h 5m 42s.

Personally, I think the overall idea of "stay-positive" not only benefit the generated images detection. It would be helpful to discuss how the method might be extended to other media types (audio, video) or multimodal content.
We agree with the reviewer’s point. While the scope of our current work is focused on fake image detection, we believe the core principle of ignoring features associated with the real distribution will apply to other forms of media forensics, such as video and audio. We will address this in the final version of the paper.

The paper could be strengthened by exploring more diverse post-processing operations beyond compression and resizing, for example, random noise, etc.
We thank the reviewer for raising this point, we have tested the sensitivity of our approach to JPEG Compression, additive gaussian noise and low-pass filtering based on the suggestions from various reviewers. We use the same experimental setting from Sec 3.1, where we take real images from reddit (Desai et al., 2021) and fake images from Stable Diffusion 1.5.
Link: https://imgur.com/a/HtYRCvO
We notice that both our Corvi+ and our Rajan+ are very robust to post-processing operations. This shows that our detector can reliably detect fake images in the wild.

The authors' point that the distribution of real samples is harmful to detectors may need further discussion and verification. Prior works show the benefits of “positive samples”
We would like to make some clarifications. We are unsure of the exact meaning of 'positive samples,' but we assume it refers to real images. Our paper does not suggest that using real images for training harms the detector. In fact, we also incorporate real images in our training process. The key finding of our work is that associating specific patterns with the real distribution can often be spurious, which undermines the detector’s reliability.

We provide concrete evidence for this claim. In Section 3.1, we show that the real distribution may contain unknown spurious correlations. Section 3.2 demonstrates that a detector trained to distinguish real images from LDM-generated ones can mistakenly associate certain features with real images. However, these same 'real' features appear in FLUX-generated images, proving the unreliability of 'real features' learned by discriminative models. Our results in Section 5 confirm this, as also noted by other reviewers (JDtd, GtjV, Qhvq).

The DIRE detector suggested by the reviewer supports our argument by associating JPEG compression with real images, leading to spurious correlations, as discussed in AEROBLADE (Ricker et al., 2024) Section 9. Similarly, Work [2] attempts to reduce intra-class variability in real images but remains susceptible to the same issue. As shown in Section 3.2, the features defining 'realness' relative to a generator are often spurious.

The benchmarks provided by this paper are partially missing. There are larger benchmarks than the one in this paper.
We seek clarification on what the reviewer means by “partially missing.” We assume this refers to the claim of not testing our method on popular public benchmarks. However, we respectfully disagree. As detailed in Appendix A.3, we evaluate our model on GenImage, a widely used, modern benchmark for fake image detection. Our GAN-based detector is also tested on the established CNNDet benchmark (line 329, Appendix A.5.2). While our primary benchmark is the publicly available dataset from Rajan et al. (2024), chosen for its inclusion of images from recent generators, we have also tested our LDM-based detector on the Autoregressive/Diffusion Models from the UFD benchmark, as suggested by the reviewer, the results can be found in https://imgur.com/a/eLTN1Kv. Our results show that the stay-positive algorithm improves detector performance across various unseen generators, hopefully addressing the reviewer’s concerns.

The robustness tests in fake image detection also include the effects of JPEG compression and Gaussian noise. The authors should provide more robustness experimental tests.
Please refer to the response to reviewer JDtd.

Include Ablations
We assume the reviewer refers to ablating other design choices for stay-positive. To do so, we conducted two ablations: (i) clamping detector weights without re-training, and (ii) re-training the entire network while clamping only the last layer.

Results: https://imgur.com/a/H8fuyIZ

Our results (similar to Table 2) show that clamping without re-training leads to suboptimal performance due to improper reweighting of fake features. Training the entire backbone while clamping the final layer underperforms on FLUX images, likely due to newly learnt spurious fake features. We hope this clarifies the reviewer’s concerns.

The writing of this paper needs further improvement, for example, some quotation marks are incorrectly written
We're happy to refine the writing but request the reviewer specify which parts need improvement. The example regarding incorrect quotation marks is unclear, could the reviewer point to the relevant line or section?

Supplementary Material: None.
We respectfully point out that this statement by the reviewer is incorrect. Our Appendix includes five sections that thoroughly discuss various details, and this has been acknowledged and confirmed by the other reviewers.

Please unify the format of references.
We thank the reviewer for the suggestion and will unify the citation formats in the final version.

It would be better if the authors could show some visualization samples where the model fails to classify and analyze the reasons.
In the Limitations section (Fig. 7), we show that our Corvi+ detector struggles with upsampled real images due to reliance on spurious features. Additionally, our models (Corvi+, Rajan+) fail to detect fake images from generators entirely different from the training distribution. Here are some qualitative examples:

Firefly images (Detector trained on LDM images cannot detect these): https://imgur.com/a/GagThLg
Real Images and Upsampled Versions (Corvi, Corvi+ can detect the original 512x512 ones but cannot detect the upscaled 1024x1024 ones): https://imgur.com/a/MHX3Py0