测试无训练生成图像检测器在不同设置下的脆弱性，发现结果易受细节影响。
How Fragile Are Training-Free AI-Generated Image Detectors? A Controlled Audit of Score Direction, Preprocessing, and Compression
- 对比两种无训练检测方法及预处理方式的影响
- 同一方法在不同参数下表现差异可达0.38 AUROC
- 结果可靠性依赖统一评估标准，适合研究检测器鲁棒性者阅读
无训练的AI生成图像检测器承诺无需分类器训练即可部署，但其报告性能常缺乏统一控制条件下的比较。本文对两种代表性无训练评分方法——基于自编码器重构的AEROBLADE风格和基于噪声扰动特征相似性的RIGID风格——以及一个朴素的特征kNN对照，在1,500张源自GenImage的数据集上进行了审计，涵盖七种生成器及JPEG压缩质量70和50。结果显示：（i）实现细节伪装成方法差异：更换LPIPS骨干网络（AlexNet → VGG-16）使整体AUROC提升0.085；切换至512像素缩放或原分辨率预处理，导致各生成器结论波动高达0.38 AUROC。（ii）评分方向并非方法固有属性，而是超参数决定：在sigma=0.05时，RIGID风格在SD1.5和Wukong上反向（AUROC < 0.5），sigma=0.01时全部恢复>0.5，sigma=0.3时降至0.15。（iii）数据格式偏差夸大鲁棒性：未统一重编码时，JPEG-50下AUROC高于干净条件；经偏差修正后，异常仅剩BigGAN。审计显示各评分失败集合互补，但简单z-score融合无法超越最优单一分数，表明需方向感知组合才能发挥互补优势。
原文摘要 · Abstract (English)
Training-free detectors of AI-generated images promise generator-agnostic deployment without classifier training, yet their reported numbers are rarely compared under a single controlled protocol. We audit two representative training-free scores -- an autoencoder-reconstruction score (AEROBLADE-style) and a noise-perturbation feature-similarity score (RIGID-style) -- plus a naive feature-kNN control, on a common 1,500-image GenImage-derived benchmark spanning seven generators and JPEG compression at quality 70 and 50. The audit yields three cautionary findings. (i) Implementation details masquerade as method differences: replacing the LPIPS backbone (AlexNet -> VGG-16) changes overall AUROC by +0.085, and switching between resize-to-512 and native-resolution preprocessing flips per-generator conclusions by up to 0.38 AUROC. (ii) Score direction is not a property of the method but of its hyperparameters: the RIGID-style score is inverted (AUROC < 0.5) on SD1.5 and Wukong at noise level sigma=0.05, recovers to >0.5 for every generator at sigma=0.01, and collapses to 0.15 at sigma=0.3. (iii) Dataset format bias inflates robustness claims: without unified re-encoding, AUROC under JPEG-50 exceeds the clean condition for the AlexNet-backbone reconstruction score; after bias correction the residual anomaly localizes to a single generator (BigGAN). The audited scores have complementary per-generator failure sets, but naive z-score fusion does not beat the best single score, indicating that exploiting complementarity requires direction-aware combination.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。