Pith. sign in

REVIEW 5 major objections 4 minor 1 cited by

Adversarially Robust AI-Generated Image Detection for Free: An Information Theoretic Perspective

T0 review · 5 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A standard detector can be made adversarially robust for free: flag samples whose prediction entropy or denoising KL divergence leaves the clean range, then flip the label.

desk verdict Plausible empirical defense with big reported gains, but the theory is loose and the adaptive evaluation never attacks the full decision rule. read the letter →

arxiv 2505.22604 v2 pith:7N7V4IZ2 submitted 2025-05-28 cs.CV

Ruixuan Zhang , He Wang , Zhengyu Zhao , Zhiqing Guo , Xun Yang , Yunfeng Diao , Meng Wang This is my paper · ORCID
classification cs.CV
keywords AI-generatedimagedetectionadversarialrobustnesstraining-freedefensepredictionentropyKLdivergencemutualinformationfeatureshifttrainingcollapse
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that adversarial training, usually the go-to defense, breaks down when applied to AI-generated image detection: the learned features become entangled and the mutual information between features and labels collapses, leaving accuracy and robustness near chance. It traces this collapse to an information-theoretic decomposition in which maximizing mutual information for adversarial samples competes with preserving it for clean samples. In place of training, the paper proposes TRIM, which treats adversarial feature shift as an anomaly signal: a pretrained detector's prediction is corrected when the input's softmax entropy falls outside a fixed band, or when the KL divergence between outputs before and after random denoising exceeds a threshold. If the reported results hold, robust fake-image detection no longer needs retraining or purification, and can survive cross-generator and degraded-image settings while keeping near-original clean accuracy.

What carries the argument

The machinery is the adversarial feature shift under standard training: successful attacks move the detector's feature representation $\Delta Z$ far from the clean feature $Z$, while clean inputs and failed attacks stay close. TRIM measures this shift indirectly rather than reconstructing the clean image. Its first stage thresholds prediction entropy $H(\tilde{y}|\tilde{Z})$—low entropy suggests a confident white-box attack, high entropy a boundary-pushing black-box attack—and inverts the label for out-of-band samples. Its second stage applies a randomized denoiser (Gaussian blur, random-resized crop, horizontal flip) and uses the KL divergence between pre- and post-denoising softmax outputs as a proxy, via Proposition 3, for $I(Z_b-Z_a; y_b|Z_a)$; samples above threshold are also inverted. The theoretical backbone is the approximate identity $I(\tilde{Z};Y)\approx I(Z;Y)+I(\Delta Z;Y|Z)$, which the paper uses both to explain why adversarial training collapses and to justify detecting attacks through entropy and divergence anomalies.

What would settle it

Craft white-box PGD adversarial examples whose loss includes a penalty for deviating from the clean-sample entropy distribution and an additional penalty on the KL divergence between pre- and post-denoising outputs, all within the usual 8/255 budget; if such examples still flip the detector while passing the thresholds, TRIM's robustness drops to near the undefended level. This directly tests the separation that Proposition 2 asserts rather than proves.

Watch

Extended reading notes

Core claim

The central claim is that standard, off-the-shelf AIGI detectors already contain enough information to defend themselves: adversarial attacks displace their feature representations far from clean ones, and this "adversarial feature shift" can be read off from prediction entropy and from the KL divergence induced by random denoising. The paper derives the shift-entropy link from a mutual-information decomposition (Proposition 2) and the shift-KL link from an upper bound on conditional mutual information (Proposition 3). TRIM therefore needs no training: it flags any input whose entropy is outside $[H_{\min},H_{\max}]$ or whose post-denoising KL divergence exceeds $\tau$, and flips the predicted label. Across CNNSpot, UnivFD, FreqNet, and NPR detectors, on ProGAN and GenImage and against PGD, C&W, FAB, AutoAttack, Square, and StealthDiffusion, the paper reports average robust accuracy of 91.97% and 83.96% respectively, with clean accuracy close to the original detector's. It also reports that adaptive attacks crafted to mimic clean entropy are countered once the denoising stage is added.

Load-bearing premise

The defense assumes that every adversarial sample that flips the detector's label either lands outside the fixed entropy band or produces a large post-denoising KL divergence, and that an attacker who knows these checks cannot keep both statistics inside the clean range while still fooling the detector.

Editorial extensions

If this is right

  • If TRIM's results hold, any existing AIGI detector can be made robust to current attacks by appending two threshold checks, with no retraining, no new data, and no auxiliary generative model.
  • Adversarial training can be set aside for this task; the paper's mutual-information diagnosis explains why AT-style objectives collapse and points future defenders away from them.
  • Robustness transfers across generators: thresholds fixed on ProGAN retain high robust accuracy on GenImage and Stable Diffusion images, so deployment may not require per-generator tuning.
  • The defense remains substantially effective under JPEG compression and Gaussian blur, which purification-based defenses often struggle with.
  • Because TRIM is model-agnostic, the same procedure applies to CNN-based, CLIP-based, frequency-based, and pixel-artifact detectors.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the entropy-plus-KL anomaly logic could transfer to other binary media authenticity tasks, such as deepfake faces, synthetic video, or cloned audio, whenever those detectors also show large feature shifts under attack.
  • Beyond the paper: an adaptive attacker aware of the thresholds could add entropy- and KL-regularization terms to the attack loss; whether TRIM survives then becomes an empirical question about whether such constrained perturbations fit within the distortion budget.
  • Beyond the paper: the threshold values are detector-specific and sometimes dataset-specific (FreqNet needs different KL thresholds per dataset), so a principled calibration rule for setting them automatically would be the next step toward turnkey adoption.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper studies adversarial robustness of AI-generated-image (AIGI) detectors. It first observes that adversarial training (AT) collapses on AIGI detection and explains this through a mutual-information decomposition, arguing that AT entangles features and reduces I(Z;Y). It then proposes TRIM, a training-free defense that wraps a standard detector with two detection stages: a softmax-entropy threshold test and a KL-divergence test between predictions on the original and randomly denoised inputs. When an input is flagged as an adversarial example, the detector's prediction is flipped. The authors report large robustness gains over AT, purification, and feature-squeezing baselines across four detectors, three datasets, and several attacks, including two adaptive attacks, and they claim this is the first training-free adversarial defense for AIGI detection.

Significance. If the empirical claims hold, TRIM would be a practically valuable and unusual result: a training-free, model-agnostic wrapper that converts standard AIGI detectors into robust detectors while preserving clean accuracy. The paper deserves credit for evaluating across multiple detectors, datasets, attacks, cross-generator settings, and image degradations, and for reporting the AT collapse phenomenon with convergence plots. The theoretical framing via mutual information is suggestive but not yet rigorous, and the central robustness claim is not validated against an adaptive adversary that optimizes against the full TRIM decision rule. The reported gains are large, but the manual, per-detector and sometimes per-class threshold selection in Appendix C.4 makes the current numbers partly a function of chosen operating points.

major comments (5)
  1. [Section 4.3, Algorithm 1] The adaptive evaluation does not attack the defense that is actually proposed. Adapt1 is PGD with epsilon=1/255 and Adapt2 is C&W with kappa=0; both are described as forcing entropy into the benign range, but neither optimizes a loss that simultaneously keeps entropy inside [tau_low, tau_high] and keeps the denoising KL divergence below tau_KL under the actual randomized denoiser. Since Algorithm 1 and all thresholds are public, a knowledgeable adversary can build a differentiable surrogate for the full TRIM decision and run PGD or C&W against it. Without such an experiment, the central claim that TRIM is robust against adaptive attackers is not established; the numbers in Table 3 may reflect only partially adaptive attacks.
  2. [Appendix B.3, Eq. (22)] Corollary 2 asserts I(Z_b - Z_a; y_b | Z_a) ≈ I(Z_b; y_b) - I(Z_a; y_b), but this identity does not follow from Eq. (16) (Proposition 1), and it is not generally true in information theory. Conditioning on Z_a does not reduce the difference of two marginal mutual informations to the conditional mutual information of the difference. Proposition 3 and the KL-threshold defense rely on this equation as the bridge between the conditional MI and the KL divergence, so the theoretical support for Step 2 of TRIM is currently missing. A correct derivation or a clearly stated additional assumption is needed.
  3. [Appendix B.2, Proposition 2] The proof of Proposition 2 is qualitative rather than formal: it argues that H(tilde_y) has a 'large overlap' with H(Delta Z) or H(Z) depending on attack success, supported by the Venn diagrams in Figures 8 and 9. No precise generative model or measure-theoretic statement is supplied. Since the entropy-threshold defense depends on the separation between clean and misclassified adversarial samples, the paper should either formalize the dominance assumption or explicitly reframe Proposition 2 as an empirical observation. As written, the thresholding rule is motivated by an unproved assertion.
  4. [Appendix C.4] The thresholds are manually configured per detector, and for NPR and FreqNet the KL threshold also depends on the predicted class and the dataset. This means the reported robustness numbers reflect operating points chosen after seeing the attack evaluations, rather than quantities derived from the information-theoretic analysis. The paper should report how the thresholds were selected, perform a sensitivity analysis over the threshold values, and ideally fix a single threshold per detector on a validation set that is separated from the attack evaluation. Without this, the 33.88% and 28.91% improvements in Table 1 are difficult to interpret as a parameter-free or 'for free' defense.
  5. [Appendix B.1, Proposition 1] The proof of Proposition 1 assumes H(Y|Z, Delta Z) ≈ H(Y|Z + Delta Z) because Z + Delta Z 'completely reconstructs' tilde Z. But knowing the sum Z + Delta Z does not in general determine Z and Delta Z individually, so the conditional entropies are not approximately equal without an additional independence or sufficiency assumption. Since this approximation underlies the decomposition of I(tilde Z; Y) that is used to explain the AT collapse, the claim should be either proved under explicit assumptions or softened to a heuristic motivation.
minor comments (4)
  1. [Throughout] There are several typos and spacing errors, e.g., 'detectorts', 'AIGI detectetion', and 'F or AIGI detection' in Section 3.1; the paper would benefit from a careful proofread.
  2. [Appendix C.4, FreqNet settings] The notation '1×5−1' for the FreqNet entropy upper threshold appears to be a typo; it should presumably read 1×10^{-1} or a similar power-of-ten value.
  3. [Figure 6] The histograms of entropy and KL divergence would be easier to interpret if the axes were labeled and the curves for clean versus adversarial samples were distinguished in a legend; currently the reader must infer the color mapping from the text.
  4. [Table 3] The 'Entropy' baseline used in the adaptive-attack ablation is not fully specified; it should state whether it uses the same entropy thresholds as TRIM and whether it includes the same denoising stage.

Circularity Check

1 steps flagged · score 4.0 of 10

AT-collapse MI measurement is self-definitional; TRIM's threshold rule is a hand-configured operating point, but the core robustness claim retains independent empirical content.

  1. self definitional [Section 2 'Rethinking Adversarial Training via Mutual Information' and Appendix C.2, Eqs. (30)-(33), Fig. 2]
    "Next, We use the decomposition: I(∆Z;Y|Z) = I(Z˜;Y) − I(Z;Y), where Z˜ = Z + ∆Z is the feature representation of adversarial inputs. I(Z˜;Y) is estimated in the same way as I(Z;Y), but using adversarial inputs ... Therefore, we approximate I(∆Z;Y|Z) as: I(∆Z;Y|Z)≈CrossEntropy(Y,Ŷ)−CrossEntropy(Y,Ŷadv)."

    The paper claims to observe an information-theoretic trade-off (I(Z;Y) stays near zero and I(∆Z;Y|Z) stays low) that 'causes' adversarial-training collapse, but the quantity I(∆Z;Y|Z) is not measured independently: it is defined as the clean-minus-adversarial cross-entropy difference (Eq. 33). Under the documented collapse both cross-entropies are ≈ ln2, so the difference is mechanically ≈0 and I(Z;Y)≈H(Y)−ln2≈0. Fig. 2 therefore restates the estimator rather than providing evidence for the proposed decomposition; the 'cause' is built into the definition of the measured quantity.

full rationale

TRIM itself is an explicit threshold rule (entropy band plus KL-after-denoising threshold), and its reported robustness numbers are empirical accuracies of that rule under the listed attacks; they do not reduce to the information-theoretic propositions. The main circularity is confined to Section 2 / Appendix C.2, where the conditional MI used to explain AT collapse is defined as a difference of cross-entropies, so the observed trade-off is an algebraic consequence of the estimator. The manual per-detector, per-dataset, per-class thresholds (Appendix C.4) are a limitation: the operating point is chosen by hand and the adaptive attacks in Section 4.3 target only the entropy stage, not the full entropy+KL rule. Those are robustness-evaluation concerns rather than circularity, and they do not make the central TRIM claim equivalent to its inputs. Score 4 reflects one genuine definitional reduction in the supporting AT analysis while the main defense claim retains independent empirical content.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical or mathematical entities; 'adversarial feature shift' is a named empirical phenomenon rather than a postulated entity. The load-bearing assumptions are the approximate MI identities in Propositions 1-3 and the manual thresholds in the method.

free parameters (3)
  • Entropy thresholds tau_low, tau_high = e.g., CNNSpot (1e-15, 1e-1), UnivFD (1e-6, 6e-1), NPR (1e-25, 1e-1), FreqNet (1e-20, 1e-5)
    Manually configured per detector and used to decide which predictions to flip. The paper states in Section 5 that thresholds need manual configuration.
  • KL divergence threshold tau_KL = CNNSpot/UnivFD: 1; NPR: 1e-10 for real, 1e-6 for fake; FreqNet: 1e-6/1e-2 for ProGAN, 1e-4/1e0 for GenImage
    Varies by detector, predicted class, and dataset. This threshold controls the second-stage flip decision and is not derived from theory.
  • Random denoising hyperparameters = GaussianBlur kernel 3, sigma 0.8; RandomResizedCrop scale (0.5,1.0); RandomHorizontalFlip p=1
    Hand-selected for the denoising stage; no sensitivity analysis or automatic selection procedure is reported.
assumptions (4)
  • ad hoc to paper Conditional entropies H(Y|Z,Delta Z) and H(Y|Z_tilde) are approximately equal, simplifying Eq. (13) to Eq. (16).
    Invoked in the proof of Proposition 1 in Appendix B.1 to remove two correction terms; no supporting data or derivation is given.
  • domain assumption For successful adversarial examples the prediction y is dominated by Delta Z and the triple mutual information I(Z;Delta Z;y) is negligible; for failed ones y is dominated by Z.
    Core premise of Proposition 2 in Appendix B.2, justified only by a qualitative Venn-diagram style argument citing [55], not by computation.
  • ad hoc to paper I(Z_b - Z_a; y_b | Z_a) is approximately I(Z_b; y_b) - I(Z_a; y_b), as stated in Corollary 2, Eq. (22).
    Asserted without proof in Appendix B.3; this identity is the bridge that turns KL divergence into a mutual-information bound.
  • standard math Cross-entropy loss approximates conditional entropy H(Y|Z) for mutual-information estimation.
    Standard approximation used in Appendix C.2 and in the information bottleneck literature [25,26,27].

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarially Robust AI-Generated Image Detection for Free: An Information Theoretic Perspective." pith.science (2026). https://pith.science/paper/7N7V4IZ2

@misc{pith2026250522604,
  author       = {Pith},
  title        = {Pith review of: Adversarially Robust AI-Generated Image Detection for Free: An Information Theoretic Perspective},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7N7V4IZ2}},
  note         = {Machine review of arXiv:2505.22604}
}
read the original abstract

Rapid advances in Artificial Intelligence Generated Images (AIGI) have facilitated malicious use, such as forgery and misinformation. Therefore, numerous methods have been proposed to detect fake images. Although such detectors have been proven to be universally vulnerable to adversarial attacks, defenses in this field are scarce. In this paper, we first identify that adversarial training (AT), widely regarded as the most effective defense, suffers from performance collapse in AIGI detection. Through an information-theoretic lens, we further attribute the cause of collapse to feature entanglement, which disrupts the preservation of feature-label mutual information. Instead, standard detectors show clear feature separation. Motivated by this difference, we propose Training-free Robust Detection via Information-theoretic Measures (TRIM), the first training-free adversarial defense for AIGI detection. TRIM builds on standard detectors and quantifies feature shifts using prediction entropy and KL divergence. Extensive experiments across multiple datasets and attacks validate the superiority of our TRIM, e.g., outperforming the state-of-the-art defense by 33.88% (28.91%) on ProGAN (GenImage), while well maintaining original accuracy.

Figures

Figures reproduced from arXiv: 2505.22604 by the authors.

Figure 1
Figure 1. Comparison of standard and adversarially trained detectors. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Mutual information I(Z; Y ), I(∆Z; Y |Z) and I(Z˜; Y ) as a function of training steps. Fig. 1b shows that the adversarially trained detector assigns nearly identical confidence scores to real and fake classes, revealing poor discriminative ability. In contrast, a standard detector trained only on clean data yields well-separated features and distinct confidence distributions, confirming that the degradation arises … view at source ↗
Figure 3
Figure 3. The l2 norm of feature shifts under different adversarial perturbation amplitudes. Left: all PGD adversarial samples. Middle: only successful PGD and AutoAttack samples. Right: only failed adversarial samples. Note that the x-axis in the right plot is set up to ϵ ≤ 1.5/255 to ensure there are failed attacks. 3 Training-free Robust Detection via Information-theoretic Measures 3.1 Training-free Robust Detection Based … view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Distribution of predicted entropy of adversarial samples relative to clean samples. [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Feature distributions of adversarial and clean samples under various attacks on CNNSpot [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: Histogram of entropy and KL divergence for clean samples and adversarial examples gener￾ated by PGD (ℓ∞, 1/255) and C&W (ℓ2, κ = 0) attacks on CNNSpot and UnivFD. To better capture such differences, we compute the change in feature representations before and after deno…
Figure 7
Figure 7. Figure 7: (a) Gaussian blur; (b) JPEG compression. Each subfigure compares the standard detector [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: The visualization of I(Z; ˜y), I(∆Z; ˜y) and I(Z; ∆Z; ˜y) of successful adversarial samples [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: The visualization of I(Z; ˜y), I(∆Z; ˜y) and I(Z; ∆Z; ˜y) of unsuccessful adversarial samples. 12 [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: Convergence of loss of PGD-AT on ProGAN dataset (first row) and GenImage (second [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]
Figure 11
Figure 11. Figure 11: Convergence of loss of TRADES on ProGAN dataset (first row) and GenImage (second [PITH_FULL_IMAGE:figures/full_fig_p015_11.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle

    cs.CR 2026-08 accept novelty 5.0 of 10

    The paper unifies privacy filters, unlearnable examples, generative safeguards, adversarial CAPTCHAs, and provenance marks into a single 'adversarial attacks for good' lifecycle and evaluates them along three common axes.

Reference graph

Works this paper leans on

55 extracted references · 36 canonical work pages · cited by 1 Pith paper

  1. [1]

    Cnn- generated images are surprisingly easy to spot

    Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn- generated images are surprisingly easy to spot... for now. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8695–8704, 2020. 16

    work page 2020

  2. [2]

    Global texture enhancement for fake face detection in the wild

    Zhengzhe Liu, Xiaojuan Qi, and Philip HS Torr. Global texture enhancement for fake face detection in the wild. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8060–8069, 2020

    2020

  3. [3]

    Detecting and simulating artifacts in gan fake images

    Xu Zhang, Svebor Karaman, and Shih-Fu Chang. Detecting and simulating artifacts in gan fake images. In2019 IEEE international workshop on information forensics and security (WIFS), pages 1–6. IEEE, 2019

    2019

  4. [4]

    Leveraging frequency analysis for deep fake image recognition

    Joel Frank, Thorsten Eisenhofer, Lea Schönherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recognition. InInternational confer- ence on machine learning, pages 3247–3258. PMLR, 2020

    2020

  5. [5]

    Diffusion noise feature: Accurate and fast generated image detection.arXiv preprint arXiv:2312.02625, 2023

    Yichi Zhang and Xiaogang Xu. Diffusion noise feature: Accurate and fast generated image detection.arXiv preprint arXiv:2312.02625, 2023

    arXiv 2023

  6. [6]

    Aeroblade: Training-free detection of latent diffusion images using autoencoder reconstruction error

    Jonas Ricker, Denis Lukovnikov, and Asja Fischer. Aeroblade: Training-free detection of latent diffusion images using autoencoder reconstruction error. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9130–9140, 2024

    2024

  7. [7]

    Learning on gradients: Generalized artifacts representation for gan-generated images detection

    Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, and Yunchao Wei. Learning on gradients: Generalized artifacts representation for gan-generated images detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12105–12114, 2023

    work page 2023

  8. [8]

    Rethink- ing the up-sampling operations in cnn-based generative network for generalizable deepfake detection

    Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Rethink- ing the up-sampling operations in cnn-based generative network for generalizable deepfake detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 28130–28139, 2024

    2024

Show all 55 references
  1. [9]

    Detecting generated images by real images

    Bo Liu, Fan Yang, Xiuli Bi, Bin Xiao, Weisheng Li, and Xinbo Gao. Detecting generated images by real images. InEuropean Conference on Computer Vision, pages 95–110. Springer, 2022

    2022

  2. [10]

    Patchcraft: Exploring texture patch for efficient ai-generated image detection.arXiv preprint arXiv:2311.12397, 2023

    Nan Zhong, Yiran Xu, Sheng Li, Zhenxing Qian, and Xinpeng Zhang. Patchcraft: Exploring texture patch for efficient ai-generated image detection.arXiv preprint arXiv:2311.12397, 2023

    2023 arXiv

  3. [11]

    Vulnerabilities in ai-generated image detection: The challenge of adversarial attacks

    Yunfeng Diao, Naixin Zhai, Changtao Miao, Zitong Yu, Xingxing Wei, Xun Yang, and Meng Wang. Vulnerabilities in ai-generated image detection: The challenge of adversarial attacks. arXiv preprint arXiv:2407.20836, 2024

    2024

  4. [12]

    Exploring the adversarial robustness of clip for ai-generated image detection

    Vincenzo De Rosa, Fabrizio Guillaro, Giovanni Poggi, Davide Cozzolino, and Luisa Verdoliva. Exploring the adversarial robustness of clip for ai-generated image detection. In2024 IEEE International Workshop on Information F orensics and Security (WIFS), pages 1–6. IEEE, 2024

    2024

  5. [13]

    Fake it until you break it: On the adversarial robustness of ai-generated image detectors.arXiv preprint arXiv:2410.01574, 2024

    Sina Mavali, Jonas Ricker, David Pape, Yash Sharma, Asja Fischer, and Lea Schönherr. Fake it until you break it: On the adversarial robustness of ai-generated image detectors.arXiv preprint arXiv:2410.01574, 2024

    2024 arXiv

  6. [14]

    Robustness of ai-image detectors: Fundamental limits and practical attacks.arXiv preprint arXiv:2310.00076, 2023

    Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. Robustness of ai-image detectors: Fundamental limits and practical attacks.arXiv preprint arXiv:2310.00076, 2023

    arXiv

  7. [15]

    Think twice before detecting gan-generated fake images from their spectral domain imprints

    Chengdong Dong, Ajay Kumar, and Eryun Liu. Think twice before detecting gan-generated fake images from their spectral domain imprints. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 7865–7874, 2022

    2022

  8. [16]

    Evading deepfake detectors via adversarial statistical consistency

    Yang Hou, Qing Guo, Yihao Huang, Xiaofei Xie, Lei Ma, and Jianjun Zhao. Evading deepfake detectors via adversarial statistical consistency. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12271–12280, 2023

    2023

  9. [17]

    Exploring frequency adversarial attacks for face forgery detection

    Shuai Jia, Chao Ma, Taiping Yao, Bangjie Yin, Shouhong Ding, and Xiaokang Yang. Exploring frequency adversarial attacks for face forgery detection. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4103–4112, 2022. 17

    2022

  10. [18]

    Stealthd- iffusion: Towards evading diffusion forensic detection through diffusion model

    Ziyin Zhou, Ke Sun, Zhongxi Chen, Huafeng Kuang, Xiaoshuai Sun, and Rongrong Ji. Stealthd- iffusion: Towards evading diffusion forensic detection through diffusion model. InProceedings of the 32nd ACM International Conference on Multimedia, pages 3627–3636, 2024

    2024

  11. [19]

    Towards deep learning models resistant to adversarial attacks, 2019

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, 2019

    2019

  12. [20]

    Xing, Laurent El Ghaoui, and Michael I

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy, 2019

    2019

  13. [21]

    Pereira, and William Bialek

    Naftali Tishby, Fernando C. Pereira, and William Bialek. The information bottleneck method, 2000

    2000

  14. [22]

    Robustbench: a standardized adversarial robustness benchmark

    Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. In Joaquin Vanschoren and Sai-Kit Yeung, editors,NeurIPS Datasets and B...

    2021

  15. [23]

    Genimage: A million-scale benchmark for detecting ai-generated image.Advances in Neural Information Processing Systems, 36:77771–77782, 2023

    Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang. Genimage: A million-scale benchmark for detecting ai-generated image.Advances in Neural Information Processing Systems, 36:77771–77782, 2023

    2023

  16. [24]

    Towards universal fake image detectors that generalize across generative models, 2024

    Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detectors that generalize across generative models, 2024

    2024

  17. [25]

    Emergence of invariance and disentanglement in deep representations.Journal of Machine Learning Research, 19(50):1–34, 2018

    Alessandro Achille and Stefano Soatto. Emergence of invariance and disentanglement in deep representations.Journal of Machine Learning Research, 19(50):1–34, 2018

    2018

  18. [26]

    Information dropout: Learning optimal representations through noisy computation.IEEE transactions on pattern analysis and machine intelligence, 40(12):2897–2905, 2018

    Alessandro Achille and Stefano Soatto. Information dropout: Learning optimal representations through noisy computation.IEEE transactions on pattern analysis and machine intelligence, 40(12):2897–2905, 2018

    2018

  19. [27]

    Rana Ali Amjad and Bernhard C Geiger. Learning representations for neural network-based classification using the information bottleneck principle.IEEE transactions on pattern analysis and machine intelligence, 42(9):2225–2239, 2019

    2019

  20. [28]

    Microsoft. Dogs vs. cats. https://www.kaggle.com/c/dogs-vs-cats , 2013. Accessed: 2025-04-29

    2013

  21. [29]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks, 2020

    Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks, 2020

    2020

  22. [30]

    Pixle: a fast and effective black-box attack based on rearranging pixels

    Jary Pomponi, Simone Scardapane, and Aurelio Uncini. Pixle: a fast and effective black-box attack based on rearranging pixels. In2022 International Joint Conference on Neural Networks (IJCNN), page 1–7. IEEE, July 2022

    2022

  23. [31]

    Square attack: a query-efficient black-box adversarial attack via random search, 2020

    Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search, 2020

    2020

  24. [32]

    On adaptive attacks to adversarial example defenses, 2020

    Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses, 2020

    2020

  25. [33]

    Adversarial examples are not easily detected: Bypassing ten detection methods, 2017

    Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods, 2017

    2017

  26. [34]

    High-resolution image synthesis with latent diffusion models, 2022

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models, 2022

    2022

  27. [35]

    Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop

    Fisher Yu, Yinda Zhang, Shuran Song, Ari Seff, and Jianxiong Xiao. Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2015. 18

    2015

  28. [36]

    Progressive growing of gans for im- proved quality, stability, and variation

    Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for im- proved quality, stability, and variation. InInternational Conference on Learning Representations (ICLR), 2018

    2018

  29. [37]

    Frequency-aware deepfake detection: Improving generalizability through frequency space learning, 2024

    Chuangchuang Tan, Yao Zhao, Shikui Wei, Guanghua Gu, Ping Liu, and Yunchao Wei. Frequency-aware deepfake detection: Improving generalizability through frequency space learning, 2024

    2024

  30. [38]

    Towards evaluating the robustness of neural networks, 2017

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks, 2017

    2017

  31. [39]

    Minimally distorted adversarial examples with a fast adaptive boundary attack, 2020

    Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack, 2020

    2020

  32. [40]

    Learning transferable visual models from natural language supervision, 2021

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision, 2021

    2021

  33. [41]

    Randomized adversarial training via taylor expansion, 2023

    Gaojie Jin, Xinping Yi, Dengyu Wu, Ronghui Mu, and Xiaowei Huang. Randomized adversarial training via taylor expansion, 2023

    2023

  34. [42]

    Feature squeezing: Detecting adversarial examples in deep neural networks

    Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. InProceedings 2018 Network and Distributed System Security Symposium, NDSS 2018. Internet Society, 2018

    2018

  35. [43]

    Diffusion models for adversarial purification, 2022

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification, 2022

    2022

  36. [44]

    Robust overfitting does matter: Test-time adversarial purification with fgsm

    Linyu Tang and Lei Zhang. Robust overfitting does matter: Test-time adversarial purification with fgsm. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24347–24356, 2024

    2024

  37. [45]

    Robust clip: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models, 2024

    Christian Schlarmann, Naman Deep Singh, Francesco Croce, and Matthias Hein. Robust clip: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models, 2024

    2024

  38. [46]

    Forgery-aware adaptive transformer for generalizable synthetic image detection, 2023

    Huan Liu, Zichang Tan, Chuangchuang Tan, Yunchao Wei, Yao Zhao, and Jingdong Wang. Forgery-aware adaptive transformer for generalizable synthetic image detection, 2023

    2023

  39. [47]

    Forgery-aware adaptive transformer for generalizable synthetic image detection

    Huan Liu, Zichang Tan, Chuangchuang Tan, Yunchao Wei, Jingdong Wang, and Yao Zhao. Forgery-aware adaptive transformer for generalizable synthetic image detection. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10770–10780, 2024

    2024

  40. [48]

    Univer- sal adversarial perturbations

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Univer- sal adversarial perturbations. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 1765–1773, 2017

    2017

  41. [49]

    Adversarial example detection using latent neighborhood graph

    Ahmed Abusnaina, Yuhang Wu, Sunpreet Arora, Yizhen Wang, Fei Wang, Hao Yang, and David Mohaisen. Adversarial example detection using latent neighborhood graph. InProceedings of the IEEE/CVF international conference on computer vision, pages 7687–7696, 2021

    2021

  42. [50]

    Characterizing adversarial subspaces using local intrinsic dimensionality.arXiv preprint arXiv:1801.02613, 2018

    Xingjun Ma, Bo Li, Yisen Wang, Sarah M Erfani, Sudanthi Wijewickrema, Grant Schoenebeck, Dawn Song, Michael E Houle, and James Bailey. Characterizing adversarial subspaces using local intrinsic dimensionality.arXiv preprint arXiv:1801.02613, 2018

    2018 arXiv

  43. [51]

    Detecting adversarial examples via reconstruction-based semantic inconsistency

    Chi Zhang, Wenbo Zhou, Kui Zhang, Jie Zhang, Weiming Zhang, and Nenghai Yu. Detecting adversarial examples via reconstruction-based semantic inconsistency. InProceedings of the ACM Turing Award Celebration Conference-China 2024, pages 126–131, 2024

    2024

  44. [52]

    The devil’s advocate: Shattering the illusion of unexploitable data using diffusion models

    Hadi M Dolatabadi, Sarah Erfani, and Christopher Leckie. The devil’s advocate: Shattering the illusion of unexploitable data using diffusion models. In2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 358–386. IEEE, 2024. 19

    2024

  45. [53]

    Salient conditional diffusion for defending against backdoor attacks.arXiv preprint arXiv:2301.13862, 2023

    Brandon B May, N Joseph Tatro, Dylan Walker, Piyush Kumar, and Nathan Shnidman. Salient conditional diffusion for defending against backdoor attacks.arXiv preprint arXiv:2301.13862, 2023

    2023 arXiv

  46. [54]

    Guided diffusion model for adversarial purification.arXiv preprint arXiv:2205.14969, 2022

    Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, and Hongfei Fu. Guided diffusion model for adversarial purification.arXiv preprint arXiv:2205.14969, 2022

    2022 arXiv

  47. [55]

    Improving adversarial robustness via mutual information estimation, 2022

    Dawei Zhou, Nannan Wang, Xinbo Gao, Bo Han, Xiaoyu Wang, Yibing Zhan, and Tongliang Liu. Improving adversarial robustness via mutual information estimation, 2022. 20

    2022

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.