Intermediate Representations are Strong AI-Generated Image Detectors

Technical Summary: Intermediate Representations are Strong Detectors for AI-Generated Images

Problem Statement
The rapid advancement of generative AI models (e.g., GANs, VAEs, Diffusion Models) has enabled the creation of photorealistic synthetic images, raising significant concerns regarding misuse, deepfakes, copyright infringement, and the potential corruption of future training datasets. While effective detection is crucial, current solutions face a dilemma: training-based methods are computationally intensive and struggle to generalize to unseen data domains, whereas training-free methods often exhibit inferior detection performance. Existing training-free approaches typically rely on embeddings from the output (final) layer of pre-trained foundation models and may overlook more discriminative features available in earlier stages of the network.

Methodology
The authors propose a search-based, training-free detection framework that leverages the sensitivity of intermediate representations within pre-trained image foundation models. The core hypothesis is that the embedding space of real images is more robust to perturbations than that of AI-generated images, and that this robustness gap is more pronounced in intermediate layers than in the final output layer.

The method operates in two stages:

1. Training/Search Stage: An image pair—an original image ($x$) and a perturbed version ($\epsilon(x)$)—is fed into a frozen pre-trained feature extractor (e.g., CLIP or DINOv2). The perturbation used is defocus blur, which preserves global semantic structures while attenuating fine-grained details. The system calculates the cosine similarity between the embeddings of the original and perturbed images across all layers ($\ell = 1$ to $L$). Using a small subset of labeled training data, the algorithm searches for the optimal intermediate layer ($\ell_{opt}$) that maximizes the AUROC score in distinguishing between real and fake image pairs.
2. Inference Stage: Once $\ell_{opt}$ is identified, the detector uses exclusively the embeddings from this specific intermediate layer for all future predictions. A binary classification is performed based on a similarity threshold $\tau$: if the cosine similarity $S(x, \epsilon(x), \ell_{opt}) < \tau$, the image is classified as AI-generated.

Crucially, the underlying model weights and architecture remain frozen throughout the entire process; no fine-tuning or weight modification occurs. The "training" is strictly limited to searching for the optimal layer index.

Main Contributions

• Superiority of Intermediate Layers: The work demonstrates that intermediate layers contain richer and more expressive representations for detecting AI-generated content than the final output layer. This is supported by an Intrinsic Dimension (ID) analysis, which reveals a "hump" shape of ID across network depth (expansion in early layers, compression in later layers). The authors argue that the compressed dimensions in the final layer, while useful for downstream tasks like classification, may discard the subtle nuances necessary to distinguish real from synthetic images.
• Search-Based Framework: The authors present a simple yet effective pipeline that identifies the optimal detection layer without modifying the foundation model, thereby bridging the gap between the generalizability of training-free methods and the performance of training-based methods.
• Sensitivity to Perturbations: The method exploits the differing robustness of embedding spaces to defocus blur, showing that embeddings of real images maintain higher similarity under perturbation than AI-generated embeddings at certain intermediate depths.

Experimental Results
The method was evaluated on two comprehensive benchmarks: GenImage and Forensics Small.

• GenImage Benchmark: The proposed method achieved an average AUROC score of 0.9296, outperforming the best training-free baseline (RIGID, 0.8128) by 14.37% and the best training-based baseline (AIDE, 0.8992) by 3.38%.
• Forensics Small Benchmark: The method showed significant improvements, achieving an average AUROC score of 0.8906. This corresponds to an improvement of 39.61% over the best training-free method (RIGID, 0.6379) and an improvement of 5.14% over the best training-based method (NPR, 0.8471).
• Ablation Studies:
  • Feature Extractors: Using CLIP yielded superior results compared to DINOv2, attributed to the higher intrinsic dimension of CLIP in intermediate layers.
  • Perturbation Types: Defocus blur proved to be the most effective perturbation, likely because it preserves global structure while removing fine textures where forgery artifacts frequently occur.
  • Search Data Size: A randomly sampled subset of training data (30% of the test set size) was sufficient to identify the optimal layer, with performance remaining stable even with smaller subsets.

Significance and Claims
The work claims that the commonly used output embeddings of foundation models are suboptimal for detecting AI-generated images. By shifting the focus to intermediate representations, the authors offer a method that is both computationally efficient (no model fine-tuning) and highly effective (outperforming state-of-the-art training-based methods).

The authors position this work as a step toward reliable media forensics that is scalable with future image foundation models. They emphasize that their approach does not generate harmful content but rather provides a tool to mitigate risks associated with generative AI, such as copyright infringement and the spread of fake content. The work suggests that the "versatility" of intermediate representations represents an underutilized resource for security applications in generative AI.