{"id":"f74b2bc4-bd67-441a-8a84-014c175c48f4","arxiv_id":"2608.07999","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":9,"one_line_summary":"PE-Mamba scans layer-by-layer features of a frozen vision transformer with a bidirectional Mamba module, reporting new state-of-the-art results on UniversalFakeDetect (96.6% mACC) and AIGCDetect (95.3% mACC).","lead":"PE-Mamba is a new detector for AI-generated images that reads the outputs of every layer of a frozen vision transformer as an ordered sequence, then combines them with a bidirectional selective scan. On two standard fake-image benchmarks it reports the best accuracy so far while training only 1.3% of the model's weights.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Same-backbone ablation shows BSA-only (95.3) vs SWA-only (95.1) nearly tied on UFD, so headline gains over RINE may reflect the PE-Core backbone rather than the bidirectional SSM; AIGCDetect ablations and the learned gate value are missing.","rationale":"The reader's conditional verdict is appropriate, and I agree that benchmark-protocol cleanliness and test-set-based hyperparameter selection are real concerns. However, the single most load-bearing issue is the causal attribution: the paper claims the bidirectional selective SSM, not the backbone, drives the improved zero-shot generalization, yet its own controlled ablation on UFD shows the SSM branch (95.3 mACC) is nearly indistinguishable from a softmax-weighted average branch (95.1 mACC) when both use the same PE-Core backbone and training setup. Table 9 independently shows backbone choice explains a 4.9-point mACC spread, which is larger than the 0.2-point BSA-over-SWA gap and comparable to the full aggregation-component effect. Since RINE and most baselines do not use the 1.88B-parameter PE-Core backbone, the headline gains over those methods are confounded with backbone scale and LoRA adaptation. The final model also combines BSA and SWA via a gate rather than replacing weighted averaging, and neither the gate value nor AIGCDetect aggregation ablations are reported, so the strongest claimed cross-generator gain (+20.5 mACC over RINE) has no internal ablation supporting the SSM-specific mechanism. This does not mean the reported numbers are wrong; it means the central claim is not yet evidenced. The reader already marked the paper CONDITIONAL, and this concern sharpens the condition: a same-backbone weighted-average control and AIGCDetect ablations are needed before the mechanism claim can be accepted. I therefore leave the verdict unchanged rather than escalating to REJECT, because the architecture is clearly described, the within-UFD ablations are internally consistent, and the empirical results, while confounded, are plausible.","tokens_in":22403,"tokens_out":8009,"duration_ms":89053,"concrete_test":"Run the Table 8 aggregation ablation (none / BSA-only / SWA-only / BSA+SWA+SGA) on the AIGCDetect benchmark with the identical ProGAN-trained protocol, and add a RINE-style scalar per-layer weighted-average aggregator on the same frozen PE-Core-G14-448 + LoRA + projection stack. If SWA-only or the RINE-style aggregator lands within roughly 1 mACC of full PE-Mamba (95.3), the bidirectional SSM is not the cause of the claimed cross-generator improvement. Also report the trained gate value gamma from Eq. (6) to show whether the BSA branch is actually used at inference.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is mechanistic: replacing learnable weighted-average cross-layer aggregation with a bidirectional selective SSM scan is what yields substantially more generalizable forensic representations, not the backbone alone. The evidence for this claim is weaker than it appears. In Table 8, under the same PE-Core backbone, LoRA, projection stack, and ProGAN training protocol, the BSA-only model achieves 95.3 mACC while the SWA-only model—a softmax-weighted average aggregator, conceptually the 'weighted-sum' baseline the paper argues against—achieves 95.1 mACC. The SSM branch is therefore essentially tied with a weighted-average branch on UniversalFakeDetect, the benchmark used for all ablations. Table 9 shows backbone choice alone moves mACC from 91.7 (DINOv2-L14) to 96.6 (PE-Core-G14), a range comparable to the entire aggregation-component effect. Since RINE, the closest methodological predecessor, uses a different and much smaller backbone, the large reported gaps over RINE (5.3 mACC on UFD and 20.5 on AIGCDetect) are likely dominated by the 1.88B-parameter PE-Core backbone plus LoRA, not by the SSM aggregator. Moreover, the final architecture does not actually replace weighted averaging: it combines BSA and SWA through a learned gate (Eq. 6), and the trained gate value is never reported. If the gate assigns most weight to SWA, the SSM contributes little at inference. Finally, all aggregation ablations are run only on UFD; the largest claimed cross-generator gain over RINE occurs on AIGCDetect, yet no AIGCDetect ablation isolates the BSA contribution. The empirical SOTA may be real, but the central causal attribution is currently unsupported.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"PE-Mamba is a ProGAN-trained AIGI detector built on a frozen PE-Core ViT with LoRA adaptation. It extracts per-layer CLS tokens, projects them to a common dimension, aggregates them through a bidirectional selective SSM (BSA) and a softmax-weighted sum (SWA), and fuses the two with a learned sigmoid gate. The paper reports 96.6% mACC / 99.5% mAP on UniversalFakeDetect and 95.3% mACC / 98.1% mAP on AIGCDetect, claiming state-of-the-art results over 18 detectors and attributing the gain to replacing weighted-average cross-layer aggregation with the SSM.","tokens_in":22804,"tokens_out":9137,"duration_ms":91650,"significance":"If the causal attribution were established, the idea of treating cross-layer ViT features as an ordered sequence scanned by a selective SSM would be a novel and useful contribution to AIGI detection. The paper's strengths are its standard ProGAN-only zero-shot protocol, broad baseline coverage, extensive ablations over SSM/LoRA/projection/backbone choices, and careful parameter accounting. The weakness is that the current evidence does not pin the gains on the BSA mechanism: the same-backbone BSA-versus-SWA gap is only 0.2 points on UniversalFakeDetect, no AIGCDetect component ablation is shown, and the learned gate value is not reported. With additional controlled experiments, the result could become a solid empirical contribution.","major_comments":[{"comment":"The central mechanistic claim, that the bidirectional selective SSM is what produces the large generalization gains, is not supported by the same-backbone ablation. With the identical PE-Core backbone and training protocol, BSA-only achieves 95.3% mACC and SWA-only achieves 95.1% mACC on UniversalFakeDetect, a 0.2-point difference, whereas Table 9 shows that changing the backbone alone moves mACC from 91.7 (DINOv2-L14-448) to 96.6 (PE-Core-G14-448). Since RINE uses a different backbone, the +5.3 and +20.5 point gains over RINE reported in Sections 4.3-4.4 cannot be attributed to the SSM aggregator without a same-backbone weighted-average or RINE-style baseline; please add that comparison.","section":"§4.7.3, Table 8"},{"comment":"The deployed model does not replace weighted averaging: Eq. (6) blends the BSA output z_m with the SWA output z_alpha through a learned sigmoid gate gamma, and the trained value of gamma is never reported. If delta(gamma) is near zero at convergence, the BSA branch contributes almost nothing at inference. Please report the learned gate value and add a sensitivity analysis of performance with respect to gamma.","section":"§3.5, Eq. (6)"},{"comment":"All aggregation ablations in Table 8 are performed only on UniversalFakeDetect. The largest claimed advantage over RINE occurs on AIGCDetect (+20.5 mACC), where no component ablation is reported. Please run the BSA/SWA/SGA ablations on AIGCDetect under the same ProGAN-trained protocol; without this, the claim that the BSA drives cross-generator generalization is unverified.","section":"§4.7.3 / §4.4"},{"comment":"The hyperparameters (d_state, d_expand, LoRA rank, alpha, dropout, projection dimension, number of projection layers, and training steps) are selected by ablations evaluated on the same UniversalFakeDetect benchmark that is then reported as the headline result, and all numbers are single runs without repeated seeds or error bars. This makes differences such as the 96.1-to-96.6 mACC gain from adding SGA potentially within run-to-run noise. Please add at least three seeds with mean and standard deviation for the main results and key ablations, or use an independent validation split for model selection.","section":"§4.7 / §4.1"},{"comment":"The comparison protocol is not fully specified: only the starred methods in Tables 1-2 are described as retrained on ProGAN, and no per-baseline information is given about which numbers were re-computed, input resolutions, augmentation, or training steps. Table 3 states that all detectors use the same ProGAN-trained weights, but this is only clearly true for the starred methods. Please provide a precise per-baseline protocol so that the claim of outperforming 18 detectors is verifiable under a single evaluation pipeline.","section":"§4.2, Tables 1-3"}],"minor_comments":[{"comment":"The text says forward hooks are registered on 'all normalization modules', while the Abstract and Section 1 say 'second normalization layers'; please make the extraction point consistent.","section":"§3.2"},{"comment":"Reference [52] is cited twice in the first paragraph of the Introduction; one duplicate should be removed.","section":"§1, references"},{"comment":"Table 4 reports robustness only for PE-Mamba, without comparisons to any prior detector under the same perturbations, so the conclusion that the method is 'inherently more robust' is not directly supported; please add competitor robustness results or temper the claim.","section":"§4.5, Table 4"},{"comment":"The Grad-CAM discussion is qualitative; adding a quantitative faithfulness or localization metric would strengthen the interpretability claim, though this is not required for the main result.","section":"§4.6, Figure 2"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper probably has real empirical results, but its main causal claim—that the bidirectional SSM scan is what drives the generalization—is not supported by its own ablations. On the same backbone, BSA-only gets 95.3 mACC and SWA-only gets 95.1; the backbone choice alone moves mACC from 91.7 to 96.6. So the headline gap over RINE is likely dominated by the PE-Core backbone, not the SSM.\n\nWhat is actually new: applying a bidirectional selective scan along the depth dimension of layer-wise CLS tokens is a genuine departure from the weighted-sum aggregation in RINE. The three-component fusion (BSA, SWA, learned gate) is not routine, and the paper is clearly written with a standard ProGAN-trained zero-shot protocol on UFD and AIGCDetect. The ablations are mostly well chosen, and the parameter-efficiency story (1.3% trainable) is convincing. The citation pattern is fine; RINE, Mamba, and PE-Core are all properly cited.\n\nWhere it is soft: the central attribution is unsupported for the reasons above. The learned gate value is never reported, so we do not know whether the SSM branch actually contributes at inference. Hyperparameters were selected on the same UniversalFakeDetect numbers that are then reported as the headline result. There are no error bars or repeated seeds. The robustness results have no baseline comparisons. The aggregation ablation is only on UFD; the largest claimed gain over RINE is on AIGCDetect, and there is no BSA-vs-SWA ablation there. Code is not available.\n\nThese are addressable. The empirical claim that the full system hits 96.6/95.3 may hold. But the 'why' needs rework: either report the gate value, add the missing AIGCDetect ablation, or soften the causal language.\n\nWho it is for: people working on AIGI detection and on layer-aggregation strategies for ViTs. It deserves a serious referee, but I would send it back with major revisions, not accept as is.","headline":"Solid benchmark results, but the paper's core causal claim is undercut by its own ablations.","tokens_in":23376,"tokens_out":3821,"would_cite":false,"duration_ms":37624,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"PE-Mamba claims that treating a vision transformer's layer-wise classification tokens as an ordered sequence—scanned forward and backward by a selective state-space model—generalizes to unseen AI-generated image generators better than…","keywords":["AI-generated image detection","deepfake detection","selective state space model","cross-layer feature aggregation","vision transformer","LoRA","zero-shot generalization","forensic representation"],"falsifier":"Hold out a validation split of unseen generators, tune the hyperparameters on that split, and retrain the weighted-average baseline and PE-Mamba with identical budget, augmentation, and seeds; if the AIGCDetect gap of 20.5 mACC does not reproduce under these conditions, the claim that the bidirectional scan causes the generalization gain is falsified.","tokens_in":22223,"feed_emoji":"🕵️","tokens_out":9670,"duration_ms":93951,"temperature":0.7,"pith_summary":"The paper sets out to establish that cross-layer aggregation in vision-transformer detectors should respect the order of the layers. Instead of combining intermediate CLS tokens with a learned weighted average, PE-Mamba scans them forward and backward with a selective state-space model, letting the detector accumulate forensic evidence from texture-level to semantic-level features and then reinterpret low-level cues in light of high-level context. If the claim holds, a detector trained on a single GAN generator can generalize to diffusion models and other unseen generators, outperforming 18 prior detectors while training just 1.3% of parameters. The reported results—96.6% mACC and 99.5% mAP on UniversalFakeDetect, and 95.3% mACC and 98.1% mAP on AIGCDetect—support the idea that directional aggregation, not just the backbone, drives zero-shot generalization.","feed_headline":"Ordered layer scans lift fake-image detection to 96.6% accuracy","feed_subtitle":"Reading a transformer's layers as an ordered sequence beats weighted averaging on unseen generators.","key_machinery":"The load-bearing mechanism is the bidirectional selective SSM aggregator (BSA): a Mamba-style selective state space model—a content-adaptive recurrent filter—that scans the sequence of projected layer-wise CLS tokens in natural and reversed order. The scan is content-adaptive because the input, output, and step-size matrices depend on each token, and it has a hard causal inductive bias over the layer hierarchy, unlike a learnable weighted average. A softmax-weighted aggregator (SWA) computes a learned global summary of all layer tokens as a second path, and a sigmoid-gated blend (SGA) with a learnable scalar gate fuses the two outputs before a binary detection head. The whole aggregation sits on a frozen PE-Core vision transformer adapted only through LoRA on the QKV projections, so the new modules and adaptation account for 1.3% of total parameters.","core_discovery":"PE-Mamba claims that the way a vision transformer's internal layers are combined is a primary driver of AI-generated-image detection generalization. The paper treats the sequence of layer-wise CLS tokens as an ordered signal—shallow layers carrying texture and frequency cues, deep layers carrying semantic content—and scans it in both directions with a selective state space model. The forward scan accumulates shallow-to-deep forensic evidence, the backward scan reinterprets low-level cues in light of deep context, and mean-pooling of all hidden states integrates evidence across every layer. A parallel softmax-weighted global summary and a learnable sigmoid gate fuse the two paths. On ProGAN-trained zero-shot protocols, this configuration reports 96.6% mACC and 99.5% mAP on UniversalFakeDetect and 95.3% mACC and 98.1% mAP on AIGCDetect, outperforming 18 detectors and the weighted-average baseline that uses the same cross-layer aggregation paradigm.","pith_inferences":["If layer ordering is the reason, the same bidirectional scan over sequentially ordered internal representations could help other forensics tasks, such as video deepfake detection, where frames add a second ordered dimension that the paper names as future work.","A cleaner causal test would freeze the backbone and vary only the aggregator across random seeds; the paper's ablation approximates this, but per-generator variance would make the 20.5-point gap over the weighted-average baseline more airtight.","The weak spots the paper reports—Midjourney and ADM—suggest a natural extension: mixing a small number of non-ProGAN generators into training should lift those two cases, which the paper's own future-work section proposes.","Because LoRA rank and dropout barely change results across the tested ranges, the method may be insensitive to adaptation hyperparameters, which would ease deployment."],"forward_implications":["A detector trained only on ProGAN can generalize across GAN families and diffusion generators, reducing the need for per-generator retraining.","The directional scan is the cause of the gain, not the backbone alone: in ablation, BSA alone reaches 95.3% mACC versus 90.6% with no aggregation, and the full model beats the weighted-average baseline by 20.5 mACC on AIGCDetect.","Parameter-efficient forensic adaptation is sufficient: 0.13% LoRA parameters and 1.3% total trainable parameters achieve the reported results.","The detector degrades gracefully under JPEG compression, Gaussian blur, and additive noise, keeping at least 88.4% mACC under the harshest combined perturbation.","BSA and SWA capture complementary signals, since combining them reaches 96.1 mACC versus 95.3 and 95.1 mACC for each alone, and the learned gate adds another 0.5 mACC."],"supporting_citations":[{"why":"Supplies the frozen PE-Core vision transformer backbone whose layer-wise CLS tokens are aggregated.","marker":"[2]"},{"why":"Supplies the selective state space model that the bidirectional scan adapts for cross-layer aggregation.","marker":"[19]"},{"why":"Supplies low-rank adaptation, keeping the backbone frozen with fewer than 0.13% trainable backbone parameters.","marker":"[23]"},{"why":"Supplies ProGAN, the single generator used to train all detectors in the zero-shot protocol.","marker":"[24]"},{"why":"Supplies the weighted-average cross-layer aggregation baseline that PE-Mamba replaces and exceeds.","marker":"[27]"},{"why":"Supplies the UniversalFakeDetect benchmark, the ProGAN-only training protocol, and the 19-generator zero-shot evaluation.","marker":"[68]"},{"why":"Supplies the AIGCDetect out-of-distribution benchmark that tests the same ProGAN-trained model on modern diffusion generators.","marker":"[70]"}],"fun_headline_variants":["Bidirectional layer scans lift deepfake detection to 96.6% mACC","PE-Mamba: 1.3% params trained, 96.6% mACC on AI-generated images","Two-way layer scanning improves AI-image detection across generators","Selective layer aggregation outperforms weighted sums in fake-image detection","Scan transformer layers both ways to catch more AI-generated images"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central claim depends on the comparison being clean: all 18 baselines were trained under the same ProGAN-only zero-shot protocol, and the final hyperparameters were chosen without using the reported test results.","fun_headline_variants_meta":{"raw":{"variants":["Bidirectional layer scans lift deepfake detection to 96.6% mACC","PE-Mamba: 1.3% params trained, 96.6% mACC on AI-generated images","Two-way layer scanning improves AI-image detection across generators","Selective layer aggregation outperforms weighted sums in fake-image detection","Scan transformer layers both ways to catch more AI-generated images"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00041,"raw_usage":{"total_tokens":2174,"prompt_tokens":1045,"completion_tokens":1129,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":661,"completion_tokens_details":{"reasoning_tokens":1031}},"tokens_in":661,"tokens_out":1129,"duration_ms":11594,"temperature":1.0,"reasoning_tokens":1031,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T00:34:08.416098+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Hold out a validation split of unseen generators, tune the hyperparameters on that split, and retrain the weighted-average baseline and PE-Mamba with identical budget, augmentation, and seeds; if the AIGCDetect gap of 20.5 mACC does not reproduce under these conditions, the claim that the bidirectional scan causes the generalization gain is falsified.","supporting_citations":[{"cited_title":"LoRA: Low-rank adaptation of large language models.Proceedings of the International Conference on Learning Representations (ICLR), 2022","cited_arxiv_id":null,"evidence_quote":"Supplies low-rank adaptation, keeping the backbone frozen with fewer than 0.13% trainable backbone parameters."},{"cited_title":"Leveraging representations from inter- mediate encoder-blocks for synthetic image detection","cited_arxiv_id":null,"evidence_quote":"Supplies the weighted-average cross-layer aggregation baseline that PE-Mamba replaces and exceeds."},{"cited_title":"CNN-generated images are surprisingly easy to spot","cited_arxiv_id":null,"evidence_quote":"Supplies the UniversalFakeDetect benchmark, the ProGAN-only training protocol, and the 19-generator zero-shot evaluation."},{"cited_title":"A sanity check for AI-generated image detection.Proceedings of the International Conference on Learning Representations (ICLR), 2025","cited_arxiv_id":null,"evidence_quote":"Supplies the AIGCDetect out-of-distribution benchmark that tests the same ProGAN-trained model on modern diffusion generators."}],"review_version":1}