Technical Summary: Robustness of AI-Art Detectors under Generator Shift

Problem Statement

The rapid advancement of text-to-image generative models, particularly the transition from U-Net-based latent diffusion architectures (e.g., Stable Diffusion 2.1) to Diffusion Transformer (DiT) architectures (e.g., Stable Diffusion 3.5), has created a significant security and trust challenge. While modern models produce images increasingly indistinguishable from human artwork, raising concerns regarding copyright, misinformation, and fraud, most existing AI-art detectors are trained and evaluated on the same generator families they are intended to detect.

This creates a "generator shift" vulnerability. Detectors may perform well on in-distribution (ID) data but fail when encountering images from newer, unseen architectures. The paper defines an "emerging-generator threat model" where a defender operates a fixed detector trained on older models (LDM, SD2.1) against a synthetic-media producer using a newer, publicly available generator (SD3.5m). The primary operational risk is a false negative: the detector misclassifies AI-generated content as human-created, allowing it to bypass screening mechanisms. This failure mode does not require a sophisticated adversary crafting adversarial perturbations; it arises simply from the adoption of a newer generation architecture.

Methodology

Dataset Construction

To evaluate this threat, the authors constructed a prompt-aligned out-of-distribution (OOD) dataset:

• In-Distribution (ID) Training Data: Derived from the AI-ArtBench dataset, containing 120,000 images across 10 art styles. This includes 40,000 human artwork samples and 80,000 AI-generated images from Latent Diffusion (LDM) and Stable Diffusion 2.1 (SD2.1). The dataset was balanced to 4,000 images per style per source class to eliminate frequency bias.
• Out-of-Distribution (OOD) Test Data: A new dataset of 10,000 images generated using Stable Diffusion 3.5 Medium (SD3.5m).
  • Construction Pipeline: To ensure semantic comparability, the authors used a "reverse prompting" pipeline. They selected 10,000 held-out human artwork samples (1,000 per style), used CLIP Interrogator to generate text prompts describing these images, augmented these prompts with style tags, and then generated new images using SD3.5m.
  • Quality Control: The dataset was validated using CLIPScore, Fréchet Inception Distance (FID), Kernel Inception Distance (KID), and LPIPS to ensure prompt alignment and visual diversity while maintaining distributional separation from the human reference set.

Detector Architecture and Training

Five deep learning backbones were evaluated as binary classifiers (Human vs. AI) under a frozen-backbone, linear-probe paradigm:

1. ResNet-18 and ResNet-50 (Residual CNNs)
2. EfficientNet-B0 (Compound-scaled CNN)
3. ConvNeXt-Base (Modernized CNN with Transformer-inspired design)
4. CLIP ViT-L/14 (Vision Transformer trained on 400M image-text pairs)

Training Protocol:

• The backbone weights were frozen (pretrained on ImageNet-1K or CLIP).
• A single linear classification head was trained on top of the extracted features.
• Loss function: Weighted binary cross-entropy to handle class imbalance.
• Threshold selection: Optimized on a validation set to maximize balanced accuracy, then locked for all test evaluations to simulate a fixed deployment scenario.

Evaluation Metrics

Performance was measured on three disjoint sets: Validation, ID Test (LDM/SD2.1), and OOD Test (SD3.5m). Key metrics included Balanced Accuracy, Precision, Recall (specifically for AI detection), False Negative Rate (FNR), and ROC-AUC. Additionally, Grad-CAM was used to analyze spatial attribution for failure cases.

Key Results

In-Distribution Performance

All five detectors achieved strong performance on the ID test set (images from LDM and SD2.1).

• CLIP ViT-L/14 performed best with a balanced accuracy of 0.9969 and an FNR of 0.3%.
• ConvNeXt-Base followed with 0.9727 balanced accuracy.
• CNN-based models (ResNet, EfficientNet) showed lower but still high performance (0.92–0.96 range).
• The models successfully distinguished between human and AI images from the training generator families.

Out-of-Distribution (Generator Shift) Performance

When evaluated on the SD3.5m dataset, all models suffered a substantial performance drop, confirming the vulnerability to generator shift.

• Performance Degradation: Balanced accuracy dropped significantly across all models.
  • CLIP ViT-L/14: Dropped from 0.9969 to 0.7829 (a 21.4 percentage point drop).
  • ResNet-18: Dropped from 0.9260 to 0.6688 (a 25.7 percentage point drop).
• Asymmetric Failure Mode: The degradation was characterized by a sharp increase in False Negatives (missed AI detections) while False Positives (misclassifying human art as AI) remained low.
  • For CLIP ViT-L/14, the False Negative Rate on SD3.5m rose to 43.24%, meaning nearly half of the new AI images were misclassified as human.
  • The False Positive Rate remained low (0.19%), indicating the detectors remained conservative in labeling human art as AI.
• Model Ranking: CLIP ViT-L/14 remained the most robust model overall, followed by ConvNeXt-Base. However, even the best model missed a substantial fraction of SD3.5m images.

Style-Wise Analysis

Performance varied significantly by artistic style:

• Realism was the most difficult style, with mean OOD recall as low as 0.337 (detectors missed ~66% of AI images).
• Ukiyo-e was the easiest style, with mean OOD recall of 0.758. The authors attribute this to the distinctive visual structure of Ukiyo-e (flat colors, bold outlines) which remains detectable even in the new generator.
• Grad-CAM Analysis: Visualizations revealed that for ID true positives, models focused on specific local cues (faces, textures). For OOD false negatives, activation maps were weaker, diffuse, and often focused on peripheral regions, suggesting the specific forensic cues learned from LDM/SD2.1 do not transfer to SD3.5m.

Significance and Claims

The paper claims that strong in-distribution accuracy is not a sufficient indicator of detector robustness when the underlying generative architecture changes. The study highlights a critical "generalization gap" in current AI-art detection systems.

Key implications drawn by the authors include:

1. Evasion via Architecture Shift: The threat does not require an adversarial attacker to craft perturbations. Simply switching to a newer, publicly available generator (like SD3.5) is sufficient to degrade detector reliability, creating a "low barrier" evasion pathway.
2. Operational Risk: The primary risk is the false negative. In real-world workflows (e.g., content moderation, fraud review), this allows synthetic content to pass undetected as human-created, undermining trust and security.
3. Defense Strategy: AI-art detectors should not be treated as static, standalone solutions. The authors advocate for a layered defense approach where image-based detection is just one component, supplemented by provenance metadata, watermarking, drift monitoring, and periodic re-evaluation against emerging generators.
4. Limitations: The study is modest in its scope, noting that it evaluates a specific shift (U-Net to DiT) and uses a frozen-backbone approach. It does not claim that fine-tuning or other adaptation methods would necessarily solve the problem, but rather establishes the baseline vulnerability that motivates further research into robust, adaptive detection systems.