{"id":"afa6f191-2547-4d12-9b3b-92ee8067f890","arxiv_id":"2504.15470","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A zero-shot detector for AI-generated images uses curvature and bias criteria from a diffusion model's score function and outperforms prior zero-shot methods on 20 generative model families.","lead":"This paper detects AI-generated images by measuring how strongly a pre-trained diffusion model's internal 'probability landscape' is attracted to each image, without training on any fake images. The method reports large accuracy gains over prior zero-shot detectors across 20 generative model families.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Deployed criterion is computed in CLIP space (§4.3), while the manifold derivation (Eqs. 12–18) holds for Euclidean inner products in the diffusion model's native (latent) space; no argument shows the score geometry survives the CLIP embedding.","rationale":"The reader's conditional verdict already identifies the CLIP-space transfer as the weakest assumption; I agree that it is the most load-bearing issue. The derivation in Section 4.2 is a chain of Euclidean-space identities; once the criterion is moved to CLIP feature space with cosine similarity, every step of the chain must be re-proved or replaced. The paper provides no such argument, and the limitation section even concedes that cross-model generalization lacks a comprehensive theory. This does not make the empirical finding uninteresting: the ablation table shows robustness to model choice, perturbation count, and corruption, which is genuine evidence that the deployed criterion is stable. But it is stability of a CLIP-space heuristic unless the native-space test is run. A secondary concern noted by the reader is the reconstructed RIGID baseline and the few-shot MoE label leakage; those bear on the benchmark claim but are less central than the theory–implementation mismatch. The verdict should remain conditional: the paper is publishable as a strong empirical heuristic if the theoretical language is softened, or as a theory paper if the native-space criterion is validated.","tokens_in":22152,"tokens_out":9568,"duration_ms":91862,"concrete_test":"Re-run the deployed detector exactly as in §4.3 on the same test set of 20 generative models, but replace the CLIP mapping with the identity and use Euclidean dot products in the diffusion model's native latent space (same s=64, α√d=1.28, and same threshold-calibration protocol). Compare average AUC and per-technique consistency with Table 1. If native-space Euclidean scores retain most of the 0.835 AUC and preserve the sign consistency across techniques, the theoretical derivation can plausibly explain the benchmark; if the AUC drops substantially or per-technique consistency disappears, the CLIP-space computation is what carries the detector and the manifold claim is unsupported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The method's defining theoretical statement is that C(x0) approximates the manifold-bias combination κ(x0)−D(x0)+⟨b0,x0⟩ (Claim 1, Corollaries 2 and 3). These statements are derived using Euclidean inner products, Gauss divergence theorem, and concentration of measure in the diffusion model's native data space. The deployed implementation, however, states in §4.3: 'We map u_d, h, x0 to CLIP before calculating C(x0)' and 'In CLIP space, cosine similarity is used as the correct way to multiply embeddings.' CLIP is a nonlinear, data-dependent embedding; cosine similarity in its feature space is not the Euclidean inner product used in Equations (12)–(18). Moreover, for Stable Diffusion the native space is the latent space of the autoencoder, so the score h lives there; the paper does not even specify how h is mapped to CLIP or why such a map would preserve curvature, gradient magnitude, or bias up to a monotone transform. The concentration-of-measure interchange of ˜x and x_t (Eq. 10 vs Eq. 3) is a statement about high-dimensional pixel/latent vectors, not about CLIP embeddings. Consequently, the theoretical derivation does not currently connect to the numbers in Table 1; the reported 0.835 AUC may be explained by CLIP feature statistics rather than by the claimed manifold geometry. This does not disprove the empirical method, but it removes the paper's central justification for why it should generalize.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a zero-shot and few-shot framework for detecting AI-generated images, grounded in the geometry of the probability manifold learned by a pre-trained diffusion model. The authors derive criteria that approximate the curvature, gradient magnitude, and statistical bias of the learned log-probability surface near a candidate image, using spherical perturbations and the diffusion score function. The resulting criterion C(x0) is evaluated with a Stable Diffusion backbone and CLIP embeddings, and the method is tested on roughly 200,000 images from 20 generative techniques. The headline empirical result is an average zero-shot AUC of 0.835, compared with 0.439 for RIGID and 0.444 for AEROBLADE, and the few-shot mixture-of-experts extension also outperforms the baselines. The paper includes sensitivity and ablation studies over perturbation counts, noise levels, base models, and image corruptions, as well as toy experiments supporting the local-maxima intuition for diffusion trajectories.","tokens_in":22506,"tokens_out":5505,"duration_ms":52398,"significance":"If the theoretical derivation connects to the deployed criterion, this is a meaningful contribution: it would be the first theoretically motivated zero-shot analysis of a diffusion model for generated-image detection, with strong empirical results, an unusually broad evaluation across 20 generators, and reproducible code. The explicit sensitivity analysis and the careful calibration protocol (thresholds set on real images only) are strengths, as is the honest limitation statement in Section 6 that the cross-model generalization is not fully explained. However, the significance currently depends on whether the CLIP-space implementation and the native-space manifold derivation are actually the same object; the manuscript does not yet establish this, so the central theoretical claim remains unconnected to the reported numbers.","major_comments":[{"comment":"There is a ball-radius inconsistency in the proof of Claim 1. The ball B0 is defined in Eq. (9) as {x : ||sqrt(1-alpha)x0 - x||_2 < sqrt(d alpha)}, while the boundary samples in Eq. (10) have radius sqrt(alpha)||u_d|| = sqrt(alpha d), which is consistent. However, the proof then uses the volume-to-surface ratio d/radii with 'radii = sqrt(d)', ignoring the factor sqrt(alpha). For a d-ball of radius r, |∂B0|/|B0| = d/r; with r = sqrt(d alpha), the ratio |∂B0|/(sqrt(d)|B0|) equals 1/sqrt(alpha), not 1. Consequently Eq. (15) should yield a factor of 1/sqrt(alpha) multiplying the curvature term, and Eq. (12) as stated is not a direct consequence of the preceding equations. This is load-bearing because the coefficients in C(x0) and the interpretation of the criterion depend on the correct geometric constant.","section":"4.1, Eq. (9)-(15) and Appendix D"},{"comment":"The implemented criterion is computed in CLIP embedding space, while the derivation of C(x0) as an approximation of curvature, gradient, and bias uses Euclidean inner products, the Gauss divergence theorem, and concentration of measure in the diffusion model's native data space (or latent space for Stable Diffusion). The paper states in Section 4.3 that u_d, h, and x0 are mapped to CLIP and that cosine similarity is used for multiplication, but gives no argument that the score geometry, the uniform-sphere normal directions, or the interchange between \tilde{x} and x_t survive a nonlinear, data-dependent CLIP embedding. Without such an argument, or an empirical test that the CLIP-space quantity tracks its native-space counterpart, the theoretical framework in Eqs. (12)-(18) does not currently explain the numbers in Table 1; the reported 0.835 AUC could be driven by CLIP feature statistics. This gap affects the paper's central generalization claim.","section":"4.3 and Section 3-4"},{"comment":"The zero-mean approximation in Eq. (17) is stated as following from 'integration of normals over the sphere is zero' together with the score approximating uniform spherical noise. The first of these facts applies to the geometric normal u_d/||u_d||, not to the normalized score function at an arbitrary point x on the sphere; the vanishing of the expectation of the normalized score is itself the spherical-noise assumption, not an independent consequence. Since this approximation is what eliminates the x0 term in Corollary 2 and leads to Eq. (16), its status as an assumption should be stated explicitly, and ideally validated on a real diffusion model, rather than presented as a derivation.","section":"4.2, Corollary 2, Eq. (17)"},{"comment":"The claim that the factor sqrt(1-alpha)/alpha is 'common across terms and can be absorbed' appears inconsistent with the stated Corollary 3 expression, where the bias term carries an additional factor 1/(alpha sqrt(d)) and the curvature term in Corollary 2 carries a factor 1/sqrt(alpha). The three terms in C(x0) therefore have different constants, and absorbing a common factor does not reduce them all to the same scale. The authors should specify the exact constants c1, c2, c3 after implementing the CLIP-space normalization, or state explicitly that a=b=c=1 is a heuristic reweighting rather than a consequence of the derivation.","section":"4.3, C(x0) formula"}],"minor_comments":[{"comment":"The column headers 'RIGID Top 10 Accuracy', 'AEROBLADE Top 10 Accuracy', and 'Ours Top 10 Accuracy' are confusing because the row labels also repeat the method names; a cleaner layout would separate the method rows from the metric columns.","section":"Table 1"},{"comment":"There are small textual typos: 'selection of of a,b,c' should read 'selection of a,b,c', and the sentence describing the dynamic-range adjustment would benefit from a clearer statement of the exact formula used.","section":"4.3"},{"comment":"The text says 'Perturbation strength α√d = 1.28, determining B0 radii', but with the stated α=0.01 this is ten times smaller than the radius sqrt(dα) from Eq. (9) for the d values typical of the image/latent space used here; the authors should clarify which radius is actually implemented and reconcile the notation.","section":"Section 5.1 and Table 2"},{"comment":"It is not specified in which space the perturbation vectors u_d are sampled before being mapped to CLIP, nor which dimension d enters Eqs. (9)-(10); this matters for interpreting the sensitivity analysis over α and for reproducing the method.","section":"4.3"},{"comment":"In the denominator of the second displayed equation, '1/α√(αd)' is a typographical mix of the numerator term and the norm approximation; the final result is correct, but the intermediate expression should be revised for clarity.","section":"Appendix D, Corollary 3 proof"}],"recommendation":"major_revision","confidential_remarks":"The paper has a strong empirical contribution and the authors are transparent about lack of a full theory for cross-model generalization. The main risk is that the CLIP-space implementation and the native-space manifold derivation are not connected, and the ball-radius factor in Claim 1 is an actual algebraic inconsistency rather than a presentation issue. If the authors can (a) correct the geometric constant, (b) either prove or empirically demonstrate that the CLIP-space cosine-similarity criterion tracks the derived manifold quantities, and (c) state the zero-mean approximation as an explicit assumption, the paper would be suitable for acceptance; otherwise the theoretical framework should be explicitly repositioned as motivation for a heuristic feature statistic, with the empirical evaluation retained."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe short version: this is a genuinely new zero-shot detector for AI images, with remarkably consistent results across 20 generative model families (0.835 average AUC, vs 0.439/0.444 for RIGID/AEROBLADE), and it ships code. The central idea—use a pretrained diffusion model's score function to measure curvature, gradient magnitude, and bias around a candidate image—is a real departure from reconstruction-based and CLIP-similarity baselines. The toy experiments (GMM trajectories terminating at local maxima, curvature estimator consistency) are careful and support the hypothesis that generated images sit near bumps in the learned density.\n\nThe soft spots are in the theory-to-implementation bridge. The derivation (Claims 1–3) is done in the native Euclidean space of the diffusion model, with inner products, Gauss divergence theorem, and concentration of measure. The deployed criterion is computed in CLIP embedding space with cosine similarity (§4.3). No argument is given that the score geometry, the normalization of h, or the interchange of x and x_t survive a nonlinear CLIP map. The paper does not even specify how the noise prediction h is mapped to CLIP for Stable Diffusion, where h lives in latent space. So the 0.835 AUC may be driven by CLIP feature statistics rather than the claimed manifold quantities. That does not kill the empirical method, but it means the theoretical grounding is not currently connected to the numbers.\n\nThere are also some smaller issues. The proof of Claim 1 has a missing factor: for a ball of radius sqrt(d alpha), |∂B0|/(sqrt(d)|B0|) = 1/sqrt(alpha), not 1 as written; the authors later absorb such factors into the weights a,b,c, but the inconsistency between the 1/sqrt(alpha) in the curvature term and the gradient term is not just a common factor. Corollary 2's step that the normalized score has zero expectation over the sphere is asserted, not derived. The few-shot MoE evaluation uses 1K labeled samples drawn from the same test set used for zero-shot evaluation, so the labels leak the test distribution into the classifier; the reported few-shot gains are likely inflated. And RIGID was reconstructed rather than run from official code.\n\nNone of this is fatal to the empirical claim. The method is simple, fast, and robust to JPEG and blur. A serious revision should either justify the CLIP transfer or drop the pretense that the derivation explains the CLIP-space results, fix the factor error, and redo the MoE with held-out generative families. As it stands, it's a strong empirical paper with an overstated theoretical narrative.\n\nI'd send it to reviewers. It will get a lively discussion, and with the fixes it could be a useful reference for zero-shot detection.\n\nBest.","headline":"Strong empirical zero-shot detector with a load-bearing gap between the manifold theory and the CLIP-space implementation; worth rigorous review.","tokens_in":22968,"tokens_out":3839,"would_cite":true,"duration_ms":33365,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Generated images can be told from real ones, with no training on fake data, by scoring the local curvature and bias of a pre-trained diffusion model's probability manifold.","keywords":["AI-generated image detection","zero-shot detection","few-shot detection","diffusion models","score function","manifold curvature","CLIP embedding","mixture of experts"],"falsifier":"Compute $C(x_0)$ directly on pixels, with no CLIP mapping and the diffusion model applied to spherical perturbations of the raw image, and compare AUC with the CLIP-space version on the same 200,000-image benchmark. If native-space AUC drops to the baseline level, the CLIP embedding, not the manifold geometry, is carrying the detection signal.","tokens_in":21970,"feed_emoji":"🖼️","tokens_out":10284,"duration_ms":83651,"temperature":0.7,"pith_summary":"The paper is trying to establish that AI-generated images can be detected without any training on fake images by reading the local geometry of the probability manifold learned by a pretrained diffusion model. It derives a criterion combining curvature, gradient magnitude, and statistical bias around a candidate image, then approximates that criterion with a handful of spherical perturbations run through the diffusion model's score function. On a benchmark of roughly 200,000 images from 20 generative techniques, the criterion reaches an average AUC of 0.835 with a threshold set only on real images, far above the two leading zero-shot baselines. The payoff is a detector that does not need per-generator data collection and can be plugged into few-shot pipelines to improve them further.","feed_headline":"Manifold-bias score catches AI images across 20 generators","feed_subtitle":"A diffusion model's score separates real from AI-generated images in zero- and few-shot settings.","key_machinery":"The load-bearing object is the score function $\\nabla \\log p_\\alpha(x)$, approximated by a pretrained diffusion model through the MMSE-denoiser identity $h(\\tilde{x}) = \\frac{1}{\\alpha}(\\sqrt{1-\\alpha} f(\\tilde{x},t;\\theta) - \\tilde{x})$. The paper defines total-variation curvature $\\kappa(x_0)$ as the negative divergence of the normalized score integrated over a ball, and uses Gauss's divergence theorem to rewrite it as a spherical expectation over uniformly sampled directions $u_d$; concentration of measure justifies sampling a sphere instead of the full Gaussian because the norm of high-dimensional Gaussian noise concentrates at $\\sqrt{d}$. The final criterion $C(x_0)$ is an average over $s$ spherical perturbations of the cosine similarity between the normalized noise prediction and a linear combination of perturbation, noise prediction, and image, computed after embedding in CLIP space. This machinery converts an unobservable manifold quantity into a finite statistic computable from one image plus a pretrained model.","core_discovery":"The central claim is that real images do not sit at stable local maxima of a diffusion model's learned log-probability manifold, whereas generated images do, and this difference can be measured using the score function $\\nabla \\log p_\\alpha(x)$. For a candidate image $x_0$, the paper samples perturbations on the sphere $\\partial B_0$ and proves, via the divergence theorem and the MMSE-denoiser form of the score, that an expectation over those samples equals a combination of local curvature $\\kappa(x_0)$, gradient magnitude $D(x_0)$, and a bias term $\\langle b_0, x_0\\rangle$. The implemented criterion $C(x_0)$ is a normalized inner-product average over perturbed noise predictions, computed in CLIP space, and the paper reports that it approximates manifold-bias criteria and simultaneously measures similarity between the predictions of noise and data. Evaluated on an aggregate of 20 generative techniques, it reaches average AUC 0.835 against 0.439 for RIGID and 0.444 for AEROBLADE, and improves a CLIP-based few-shot detector when combined as a mixture of experts.","pith_inferences":["If the CLIP embedding is carrying the signal, the diffusion model might be replaceable by another learned denoiser or even a different self-supervised feature space; a native-space versus CLIP-space comparison would settle this.","The cross-model generalization may reflect shared training-data biases among generators rather than shared score geometry; a test would be whether generators trained on disjoint image collections are detected less reliably.","The signed bias term suggests an extension from detection to attribution: estimating which training distribution a generated image is biased toward, not just labeling it fake.","The paper's own limitation note says there is no comprehensive theory for the cross-model capability, so the safest reading is an empirical criterion with a motivating geometric derivation rather than a closed theory."],"forward_implications":["A detector can be deployed against new generative models without collecting fake images from them; only a small set of real images is needed to calibrate the threshold.","The criterion keeps most of its accuracy when the diffusion backbone is swapped, so the approach is not locked to one model architecture.","Combining the criterion with a CLIP-based few-shot detector in a mixture-of-experts setup improves detection beyond either method alone.","The method degrades gracefully under JPEG compression and Gaussian blur, so it applies to images that have passed through common post-processing.","Detection of images from the exact diffusion model used for scoring is expected by construction; the cross-model results are presented as empirical rather than explained by theory."],"supporting_citations":[{"why":"Provides the MMSE-denoiser identity that lets the diffusion model output stand in for the score.","marker":"Miyasawa et al. (1961)"},{"why":"Establishes score-based diffusion training and the reverse SDE that justify the fixed-point analysis.","marker":"Song & Ermon (2019; 2020)"},{"why":"Contributes the hypothesis that generated samples concentrate near local maxima of learned probability, which the paper transfers from text to images.","marker":"Mitchell et al. (2023)"},{"why":"AEROBLADE, the autoencoder-reconstruction zero-shot baseline it must beat.","marker":"Ricker et al. (2024)"},{"why":"RIGID, the perturbation-similarity zero-shot baseline it must beat.","marker":"He et al. (2024)"},{"why":"The CLIP-based few-shot detector used in the mixture-of-experts combination.","marker":"Cozzolino et al. (2024a)"},{"why":"Supplies the CLIP embedding in which the numerical criterion is computed.","marker":"Radford et al. (2021)"},{"why":"Stable Diffusion, the pretrained model whose score approximation powers the criterion.","marker":"Rombach et al. (2022)"},{"why":"Concentration-of-measure result used to treat Gaussian perturbation noise as uniform on a sphere.","marker":"Laurent & Massart (2000)"}],"fun_headline_variants":["Manifold bias scores detect AI images with zero examples","Zero-shot AI image detection via manifold curvature scores","Score-based manifold bias beats state-of-art on 20 generators","Manifold-induced bias separates real from AI images without training"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the CLIP embedding, used to compute the actual detection score, preserves the curvature, gradient, and bias quantities derived for the diffusion model's native image space; the paper does not show that the embedding preserves these score-function geometries.","fun_headline_variants_meta":{"raw":{"variants":["Manifold bias scores detect AI images with zero examples","Zero-shot AI image detection via manifold curvature scores","Score-based manifold bias beats state-of-art on 20 generators","Manifold-induced bias separates real from AI images without training"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000569,"raw_usage":{"total_tokens":2721,"prompt_tokens":1004,"completion_tokens":1717,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":620,"completion_tokens_details":{"reasoning_tokens":1650}},"tokens_in":620,"tokens_out":1717,"duration_ms":12189,"temperature":1.0,"reasoning_tokens":1650,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T11:26:21.164582+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute $C(x_0)$ directly on pixels, with no CLIP mapping and the diffusion model applied to spherical perturbations of the raw image, and compare AUC with the CLIP-space version on the same 200,000-image benchmark. If native-space AUC drops to the baseline level, the CLIP embedding, not the manifold geometry, is carrying the detection signal.","supporting_citations":[{"cited_title":"Aeroblade: Training-free detection of latent diffusion images using autoencoder reconstruction error","cited_arxiv_id":null,"evidence_quote":"AEROBLADE, the autoencoder-reconstruction zero-shot baseline it must beat."},{"cited_title":"Adaptive estimation of a quadratic functional by model selection","cited_arxiv_id":null,"evidence_quote":"Concentration-of-measure result used to treat Gaussian perturbation noise as uniform on a sphere."}],"review_version":1}