Paper deep dive
The Deployment Gap in AI Media Detection: Platform-Aware and Visually Constrained Adversarial Evaluation
Aishwarya Budhkar, Trishita Dhara, Siddhesh Sheth
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 93%
Last extracted: 4/14/2026, 1:39:42 AM
Summary
The paper introduces a 'deployment gap' in AI media detection, demonstrating that detectors achieving near-perfect performance in clean laboratory settings suffer significant degradation under realistic platform-aware adversarial attacks. The authors propose a framework that models common deployment transformations (resizing, compression) and constrains adversarial perturbations to visually plausible meme-style bands, revealing that such attacks lead to high misclassification rates and calibration collapse.
Entities (5)
Relation Signals (3)
Stable Diffusion → generates → Synthetic Images
confidence 98% · Synthetic images are generated using Stable Diffusion
Deployment-Aware Adversarial Framework → exposes → Deployment Gap
confidence 95% · Our findings highlight that robustness measured under clean conditions substantially overestimates deployment robustness.
CLIP-based detector → evaluatedon → Deployment-Aware Adversarial Framework
confidence 90% · We evaluate two detector architectures... under a deployment-aware threat model.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Recent AI media detectors report near-perfect performance under clean laboratory evaluation, yet their robustness under realistic deployment conditions remains underexplored. In practice, AI-generated images are resized, compressed, re-encoded, and visually modified before being shared on online platforms. We argue that this creates a deployment gap between laboratory robustness and real-world reliability. In this work, we introduce a platform-aware adversarial evaluation framework for AI media detection that explicitly models deployment transforms (e.g., resizing, compression, screenshot-style distortions) and constrains perturbations to visually plausible meme-style bands rather than full-image noise. Under this threat model, detectors achieving AUC $\approx$ 0{.}99 in clean settings experience substantial degradation. Per-image platform-aware attacks reduce AUC to significantly lower levels and achieve high fake-to-real misclassification rates, despite strict visual constraints. We further demonstrate that universal perturbations exist even under localized band constraints, revealing shared vulnerability directions across inputs. Beyond accuracy degradation, we observe pronounced calibration collapse under attack, where detectors become confidently incorrect. Our findings highlight that robustness measured under clean conditions substantially overestimates deployment robustness. We advocate for platform-aware evaluation as a necessary component of future AI media security benchmarks and release our evaluation framework to facilitate standardized robustness assessment.
Tags
Links
- Source: https://arxiv.org/abs/2604.09706v1
- Canonical: https://arxiv.org/abs/2604.09706v1
Trouble viewing inline? Open PDF directly →
Full Text
28,123 characters extracted from source content.
Expand or collapse full text
The Deployment Gap in AI Media Detection: Platform-Aware and Visually Constrained Adversarial Evaluation Aishwarya Budhkar Indiana University abudhkar@iu.edu Trishita Dhara Upper Hand trishitadhara123@gmail.com Siddhesh Sheth Ace Rent a Car shethsiddhesh268@gmail.com Abstract Recent AI media detectors report near-perfect performance under clean laboratory evaluation, yet their robustness under realistic deployment conditions remains underexplored. In practice, AI-generated images are resized, compressed, re-encoded, and visually modified before being shared on online platforms. We argue that this creates a deployment gap between laboratory robustness and real-world reliability. In this work, we introduce a platform-aware adversarial evaluation framework for AI media detection that explicitly models deployment transforms (e.g., resizing, compression, screenshot-style distortions) and constrains perturbations to visually plausible meme-style bands rather than full-image noise. Under this threat model, detectors achieving AUC ≈ 0.99 in clean settings experience substantial degradation. Per-image platform-aware attacks reduce AUC to significantly lower levels and achieve high fake-to-real misclassification rates, despite strict visual constraints. We further demonstrate that universal perturbations exist even under localized band constraints, revealing shared vulnerability directions across inputs. Beyond accuracy degradation, we observe pronounced calibration collapse under attack, where detectors become confidently incorrect. Our findings highlight that robustness measured under clean conditions substantially overestimates deployment robustness. We advocate for platform-aware evaluation as a necessary component of future AI media security benchmarks and release our evaluation framework to facilitate standardized robustness assessment. 1 Introduction Recent advances in generative models have enabled the creation of highly realistic synthetic media, raising urgent concerns about misinformation, impersonation, and media manipulation. In response, a growing body of work has proposed AI media detectors that distinguish real from synthetic content, often reporting near-perfect performance under clean laboratory evaluation [18, 13]. However, such evaluations typically assume access to pristine images and do not model the transformations that occur during real-world content sharing. In practice, AI-generated images are rarely consumed in their original form. They are resized, compressed, re-encoded, screenshotted, and visually modified before being posted on social platforms. These transformations alter statistical cues that forensic detectors rely on. Prior work has demonstrated that distribution shifts and corruptions can significantly degrade uncertainty calibration and predictive reliability [14], while adversarial examples further expose brittleness in deep neural networks [5, 11]. Yet, the interaction between platform-induced transformations and adversarial robustness in AI media detection remains underexplored. We argue that this mismatch constitutes a deployment gap: a discrepancy between laboratory robustness and deployment robustness. Existing adversarial studies typically optimize perturbations in the pixel space under clean evaluation assumptions. Meanwhile, media forensics benchmarks often ignore adversarial threat models altogether. As a result, reported performance may substantially overestimate robustness under realistic platform conditions. In this work, we introduce a platform-aware adversarial evaluation framework for AI media detection. Our framework incorporates differentiable approximations of common deployment transforms (e.g., resizing, compression, screenshot-style distortions) into the attack loop, enabling end-to-end optimization under realistic sharing conditions. Furthermore, we constrain perturbations to visually plausible meme-style bands rather than full-image noise, reflecting common user-generated modifications. Under this threat model, detectors achieving AUC ≈0.99≈ 0.99 under clean conditions experience substantial degradation. Platform-aware, band-constrained per-image attacks induce high fake-to-real misclassification rates and significantly reduce AUC. We further demonstrate that universal perturbations exist even under localized visual constraints, revealing shared vulnerability directions across inputs. Beyond accuracy degradation, we observe pronounced calibration collapse under attack, with detectors becoming confidently incorrect under deployment-like conditions. Our findings suggest that clean laboratory evaluation substantially overestimates real-world robustness. We advocate for platform-aware robustness assessment as a necessary component of future AI media security benchmarks and release our evaluation framework to facilitate standardized deployment-aware testing. Code available at : https://github.com/trishitadhara/Platform-Aware-and-Visually-Constrained-Adversarial-Evaluation 2 Related Work 2.1 AI-Generated Media Detection The rapid progress of generative models has led to extensive research on detecting synthetic images. Early studies showed that CNN-generated images contain detectable artifacts in spatial statistics and frequency spectra [18, 4]. More recent work has focused on generalization across generators, aiming to detect images produced by unseen models [13, 3]. Patch-level consistency and universal detection approaches have also been explored [10]. While these methods report strong performance under clean evaluation, they are typically assessed using pristine images and standard test splits. Robustness under realistic deployment conditions, including platform-induced transformations, remains less systematically examined. 2.2 Adversarial Robustness Adversarial examples reveal the vulnerability of deep neural networks to small perturbations [5]. Robust optimization frameworks [11] and universal adversarial perturbations [12] have demonstrated structural weaknesses in learned decision boundaries. Athalye et al. [1] introduced expectation-over-transformation (EOT), enabling attacks to remain effective under stochastic transformations. Although adversarial robustness has been widely studied in classification tasks, its intersection with AI media detection remains underdeveloped. Existing adversarial evaluations of forensic systems often rely on unconstrained perturbations or do not explicitly incorporate realistic platform transformations. 2.3 Robustness Under Distribution Shift and Corruptions Beyond adversarial perturbations, neural networks are sensitive to natural distribution shifts and corruptions [8]. Predictive uncertainty has been shown to degrade significantly under shift [14], motivating robustness benchmarks such as ImageNet-C and WILDS [17, 9]. However, most distribution shift studies focus on natural corruptions rather than adversarial manipulations optimized under deployment pipelines. The combination of platform transformations and constrained adversarial optimization remains insufficiently studied in media security contexts. 2.4 Positioning and Novelty Existing work in AI media detection has primarily focused on improving detection accuracy under clean evaluation settings [18, 13]. Meanwhile, adversarial robustness research has demonstrated the vulnerability of deep networks to carefully optimized perturbations [11, 12]. However, these two research directions have largely evolved in parallel. Our work bridges this gap by explicitly modeling deployment conditions within adversarial evaluation for AI media detection. Unlike prior adversarial studies that assume direct access to pristine inputs, we incorporate differentiable approximations of common platform transformations into the attack loop. Furthermore, we constrain perturbations to visually plausible meme-style bands, reflecting realistic user-generated modifications rather than unconstrained full-image noise. Rather than proposing a new detector or defense, we provide a deployment-aware robustness evaluation framework. Our findings demonstrate that clean laboratory robustness substantially overestimates performance under realistic sharing conditions. We also show that universal perturbations exist even under localized visual constraints, revealing shared vulnerability directions in detection models. By formalizing and empirically analyzing this deployment gap, our work contributes a practical robustness assessment framework for AI media security research. 3 Threat Model and Methodology 3.1 Deployment-Aware Threat Model We consider the problem of AI-generated image detection under realistic deployment conditions. Let fθ(x)f_θ(x) denote a detector that outputs the probability that an image x is synthetic. Standard adversarial evaluation optimizes perturbations directly on x under pixel-level constraints. However, in real-world settings, images are rarely evaluated in pristine form. We model a deployment pipeline T consisting of transformations that approximate common platform processing operations, including resizing, compression, re-encoding, and screenshot-style distortions. Our attacker optimizes perturbations through this pipeline, seeking to minimize detector confidence under transformed inputs: minδt∼[ℓ(fθ(t(x+δ)),ytarget)], _δ\;E_t [ (f_θ(t(x+δ)),y_target) ], subject to perceptual and structural constraints. 3.2 Visually Constrained Perturbations Unlike conventional full-image perturbations [5, 11], we restrict δ to localized, visually plausible regions. Specifically, perturbations are confined to meme-style bands (e.g., top or bottom strips of the image), reflecting common user-generated modifications on social platforms. This constraint ensures that adversarial modifications remain consistent with real-world sharing behavior and avoids unrealistic full-frame noise patterns. 3.3 Per-Image and Universal Attacks We study two attack regimes: Per-image attacks, where a unique perturbation is optimized for each input, and Universal perturbations, where a single perturbation is optimized across multiple inputs [12]. Universal perturbations are of particular interest, as they reveal shared vulnerability directions in the detector’s decision boundary. Both attack types are optimized using projected gradient descent with expectation over transformations (EOT) [1] to account for stochastic deployment transforms. An overview of the proposed deployment-aware evaluation framework is shown in Figure 1. Figure 1: Overview of the deployment-aware adversarial evaluation framework. Perturbations are constrained to visually plausible meme-style bands and optimized through platform transformations using expectation-over-transformation (EOT). Detector robustness is evaluated using AUC, misclassification rate, and calibration metrics. 4 Experiments 4.1 Dataset We construct a balanced real-vs-synthetic dataset. Real images are drawn from the STL-10 dataset [2], a natural image benchmark commonly used in representation learning. Synthetic images are generated using Stable Diffusion [16] across 10 diverse prompts designed to mimic realistic photographic scenarios (e.g., urban street scenes, wildlife photography, sports events, portraits, protests, and travel imagery). Each prompt is assigned a unique identifier (prompt_id) to enable per-prompt robustness analysis. For each prompt, 100 synthetic images are generated using different random seeds to ensure diversity. Images are resized to 224×224224× 224 resolution. The dataset is split into training and test partitions, with synthetic images evenly distributed across prompts to enable per-prompt analysis. 4.2 Detectors We evaluate two detector architectures. CLIP-based detector. We adopt a CLIP ViT-based backbone [15] with a linear classification head trained to distinguish real from synthetic images. The backbone is frozen and only the classification head is optimized. ResNet-18 detector. We fine-tune a ResNet-18 classifier [7] on the same dataset. Under clean evaluation, both detectors achieve near-perfect performance (AUC ≈0.99≈ 0.99), consistent with prior reports of strong clean detection accuracy. 4.3 Attack Settings We evaluate both per-image and universal adversarial perturbations under a deployment-aware threat model. Per-image attacks. For each synthetic image, we optimize a perturbation constrained to a meme-style band region (top or bottom of the image). Optimization is performed using projected gradient descent (PGD) [11] with expectation over transformation (EOT) [1] to account for stochastic deployment transforms. The perturbation is bounded in ℓ∞ _∞ norm and spatially restricted to the designated band region. Universal perturbations. We additionally optimize a single perturbation shared across multiple synthetic images, following the formulation of universal adversarial perturbations [12]. Universal perturbations are trained using the same deployment-aware EOT framework. Deployment transforms. The transformation set includes resizing, JPEG-style compression, and screenshot-like distortions, inspired by corruption robustness benchmarks [8]. These operations are incorporated during optimization to simulate realistic platform processing. 4.4 Evaluation Metrics We report: • AUC: Area Under the ROC Curve. • Fake-to-Real Misclassification Rate: proportion of synthetic images misclassified as real. • Expected Calibration Error (ECE) [6]: to measure reliability under attack. 5 Results 5.1 Clean vs Deployment-Aware Performance Figure 2 visualizes confidence distributions for synthetic images under clean and attacked settings. Under clean evaluation, synthetic images receive high-confidence fake predictions. Under deployment-aware perturbations, the confidence distribution shifts substantially toward the real class, indicating severe robustness degradation. (a) Bottom-band attack (b) Top-band attack Figure 2: Confidence distribution for synthetic images under deployment-aware band-constrained attacks. Both top and bottom perturbations significantly shift detector confidence toward the real class. Table 1 summarizes detector performance under clean and deployment-aware adversarial conditions. Under clean evaluation, the CLIP-based detector achieves AUC =0.996=0.996 and accuracy =0.97=0.97. However, under platform-aware band-constrained attack (bottom band), AUC drops to 0.7050.705, and the fake-to-real misclassification rate increases to 0.780.78. Table 1: Overall performance under deployment-aware attack (bottom band). Setting AUC Accuracy Fake→ Rate Clean 0.996 0.970 0.055 Per-Image Attack 0.705 0.885 0.780 Universal Attack 0.923 0.825 0.345 5.2 Universal Perturbations We further evaluate universal perturbations optimized under the same deployment-aware threat model. Despite strict spatial constraints, a single perturbation achieves a fake-to-real misclassification rate of approximately 0.350.35, reducing AUC to 0.9230.923. Figure 3 compares per-image and universal attack performance. While universal attacks are weaker than per-image optimization, they demonstrate the existence of shared vulnerability directions. Figure 3: Comparison of per-image and universal platform-aware attacks under band constraints. 5.3 Per-Prompt Vulnerability To analyze semantic sensitivity, we evaluate attack success per prompt category. Figure 4 shows fake-to-real misclassification rates grouped by prompt_id. We observe variability across prompts, suggesting that robustness differs across semantic image categories. (a) Bottom-band attack (b) Top-band attack Figure 4: Fake-to-real misclassification rate per prompt category under deployment-aware band-constrained attacks. Vulnerability varies across semantic prompt categories for both top and bottom perturbation regions. 5.4 Calibration Collapse Beyond accuracy degradation, we evaluate calibration using Expected Calibration Error (ECE). Table 2 reports ECE under clean and attacked settings. Under deployment-aware perturbations, calibration error increases substantially, indicating that the detector becomes confidently incorrect. Table 2: Expected Calibration Error (ECE) under clean and attack conditions. Setting ECE Clean 0.16743 Attack (Bottom Band) 0.25064 Attack (Top Band) 0.23679 Figure 5 illustrates reliability diagrams under attack, highlighting systematic overconfidence. (a) Bottom-band attack (b) Top-band attack Figure 5: Reliability diagrams under deployment-aware attacks. Both perturbation locations induce calibration collapse, with detectors becoming overconfident on misclassified synthetic images. 5.5 Statistical Stability via Bootstrap Confidence Intervals To assess the statistical stability of our findings, we compute 95% bootstrap confidence intervals (2,000 resamples) for AUC, accuracy, and fake-to-real misclassification rate on the same evaluation slice (CLIP detector, bottom-band attack, deployment-aware evaluation). Table 3 reports the mean and confidence intervals under clean and attacked conditions. Under clean evaluation, performance is near-perfect with tight confidence bounds. Under deployment-aware attack, performance degrades substantially, with AUC decreasing from 0.9970.997 to 0.9380.938 and fake-to-real misclassification increasing from 0.0100.010 to 0.3560.356. Importantly, the confidence intervals for clean and attack settings do not overlap for key metrics, indicating that the observed degradation is statistically significant and not attributable to sampling variability. Table 3: Bootstrap 95% confidence intervals (2,000 resamples) for clean and attacked conditions (CLIP, bottom-band, deployment-aware evaluation). Metric Clean Attack AUC 0.9970.997 [0.993, 1.000] 0.9380.938 [0.914, 0.961] Accuracy 0.9920.992 [0.983, 1.000] 0.8200.820 [0.783, 0.858] Fake→ Rate 0.0100.010 [0.000, 0.026] 0.3560.356 [0.289, 0.422] 5.6 Perturbation Characterization and Perceptual Considerations We constrain adversarial perturbations under an ℓ∞ _∞ norm bound of ϵ=16/255ε=16/255 in the normalized [0,1][0,1] pixel space. This corresponds to a maximum per-pixel intensity deviation of approximately 6.3% of the dynamic range. In addition to magnitude constraints, perturbations are spatially restricted to horizontal meme-style bands covering 22% of the image height (either top or bottom), ensuring localized rather than full-frame modifications. We do not explicitly optimize perceptual similarity metrics such as LPIPS or SSIM. Instead, perceptual plausibility is enforced through the combination of a small ℓ∞ _∞ bound and strict spatial localization, reflecting common user-generated overlays and meme-style edits frequently observed on social platforms. Figure 6 provides representative qualitative examples of perturbed synthetic images. Perturbations are confined to narrow horizontal regions and remain visually subtle at standard viewing scale. Figure 6: Representative qualitative examples of band-constrained adversarial perturbations. Each row shows an original synthetic image (left) and its adversarially perturbed counterpart (right). Perturbations are localized to narrow horizontal bands and bounded by ϵ=16/255ε=16/255. We do not conduct a formal human perceptual study. While perturbations are designed to be localized and limited in magnitude, future work may incorporate user studies or perceptual similarity metrics to more rigorously evaluate visual realism. 6 Discussion 6.1 The Deployment Gap Our results reveal a clear deployment gap in AI media detection. While detectors achieve near-perfect performance under clean evaluation (AUC ≈0.99≈ 0.99), performance degrades substantially when adversarial perturbations are optimized through realistic platform transformations. Importantly, perturbations are spatially restricted to narrow meme-style bands rather than full-image noise. Despite these constraints, per-image attacks induce high fake-to-real misclassification rates and significant AUC reduction. This suggests that clean laboratory evaluation substantially overestimates robustness under realistic content-sharing conditions. 6.2 Effect of Platform Transformations A key finding is that incorporating deployment transforms directly into the attack loop enables perturbations to remain effective after resizing and compression. This highlights that robustness evaluation must account for the full deployment pipeline rather than assuming direct access to pristine inputs. Evaluating detectors solely under clean conditions risks providing a misleading sense of security. 6.3 Universal Vulnerabilities Under Spatial Constraints Although universal perturbations are weaker than per-image attacks, their non-trivial success under strict spatial constraints indicates the presence of shared vulnerability directions in the detector’s decision boundary. Even localized perturbations can systematically shift model confidence, suggesting that robustness limitations are not purely instance-specific. 6.4 Calibration and Reliability Beyond accuracy degradation, we observe pronounced calibration collapse under deployment-aware attack. Detectors become confidently incorrect on perturbed synthetic images, increasing Expected Calibration Error. From a media security perspective, this is particularly concerning: overconfident misclassification may mislead automated moderation systems or human reviewers relying on confidence scores. These findings align with broader evidence that predictive uncertainty degrades under distribution shift, but demonstrate that deployment-aware adversarial conditions exacerbate this effect. 6.5 Implications for Media Security Evaluation Our study suggests that evaluating AI media detectors without modeling realistic sharing conditions may provide an incomplete picture of robustness. We advocate for deployment-aware adversarial evaluation as a complementary benchmark dimension alongside clean accuracy and cross-generator generalization. Rather than proposing new defenses, our work emphasizes the importance of realistic robustness assessment. Future detector development should consider deployment-aware adversarial resilience as a first-class objective. 7 Conclusion We introduced a deployment-aware adversarial evaluation framework for AI media detection. While modern detectors achieve near-perfect performance under clean laboratory conditions, our results demonstrate substantial robustness degradation when perturbations are optimized through realistic platform transformations and constrained to visually plausible meme-style regions. We show that deployment-aware per-image attacks significantly reduce AUC and induce high fake-to-real misclassification rates. Universal perturbations remain effective under strict spatial constraints, indicating shared vulnerability directions in detector decision boundaries. Beyond accuracy degradation, we observe calibration collapse under attack, with detectors becoming confidently incorrect. Our findings highlight a deployment gap between laboratory evaluation and real-world robustness. We argue that platform-aware adversarial testing should become a standard component of AI media security benchmarks to better reflect realistic operating conditions. 8 Limitations Our study has several limitations. First, synthetic images are generated using a single diffusion-based model. Although prompts are diverse, robustness behavior may vary across generative architectures. Future work should evaluate detectors across multiple generator families. Second, our deployment pipeline approximates common platform transformations using differentiable operators. While these transformations capture resizing and compression effects, real-world platforms may introduce additional processing steps not modeled here. Third, we focus on visually constrained band perturbations. Other forms of realistic modifications, such as overlays, cropping, or watermark-like artifacts, may exhibit different robustness characteristics. Finally, our analysis centers on detector robustness rather than defense mechanisms. We do not propose mitigation strategies, leaving robustness improvement as an open research direction. 9 Future Work Several directions emerge from our findings. First, expanding deployment-aware evaluation to multiple generative models and larger-scale datasets would help characterize the generality of the observed deployment gap. Second, integrating platform-aware adversarial training could provide insights into whether deployment robustness can be improved without sacrificing clean accuracy. Third, extending the framework to multimodal settings, including text-image pairs or social media posts, may better reflect real-world misinformation scenarios. Finally, standardized deployment-aware robustness benchmarks could facilitate fair comparison across detectors and promote more realistic evaluation practices in AI media security research. References [1] A. Athalye, N. Carlini, and D. Wagner (2018) Obfuscated gradients give a false sense of security. In ICML, Cited by: §2.2, §3.3, §4.3. [2] A. Coates, A. Y. Ng, and H. Lee (2011) An analysis of single-layer networks in unsupervised feature learning. In AISTATS, Cited by: §4.1. [3] D. Coccomini, R. Caldelli, and A. Del Bimbo (2022) Combining efficientnet and vision transformers for deepfake detection. In ICPR, Cited by: §2.1. [4] R. Durall, J. Keuper, and F. Pfreundt (2020) Watch your up-convolution: cnn based generative deep neural networks are failing to reproduce spectral distributions. In CVPR, Cited by: §2.1. [5] I. J. Goodfellow, J. Shlens, and C. Szegedy (2015) Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR), Cited by: §1, §2.2, §3.2. [6] C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger (2017) On calibration of modern neural networks. In ICML, Cited by: 3rd item. [7] K. He, X. Zhang, S. Ren, and J. Sun (2016) Deep residual learning for image recognition. In CVPR, Cited by: §4.2. [8] D. Hendrycks and T. Dietterich (2019) Benchmarking neural network robustness to common corruptions and perturbations. In International Conference on Learning Representations (ICLR), Cited by: §2.3, §4.3. [9] P. W. Koh et al. (2021) WILDS: a benchmark of in-the-wild distribution shifts. In ICML, Cited by: §2.3. [10] X. Liu et al. (2022) Universal fake image detection using patch consistency. In ECCV Workshops, Cited by: §2.1. [11] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu (2018) Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR), Cited by: §1, §2.2, §2.4, §3.2, §4.3. [12] S. Moosavi-Dezfooli, A. Fawzi, and P. Frossard (2017) Universal adversarial perturbations. In CVPR, Cited by: §2.2, §2.4, §3.3, §4.3. [13] U. Ojha, Y. Li, and S. Jha (2023) Towards universal fake image detectors that generalize across generative models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Cited by: §1, §2.1, §2.4. [14] Y. Ovadia, E. Fertig, J. Ren, Z. Nado, et al. (2019) Can you trust your model’s uncertainty? evaluating predictive uncertainty under dataset shift. In Advances in Neural Information Processing Systems (NeurIPS), Cited by: §1, §2.3. [15] A. Radford, J. W. Kim, C. Hallacy, et al. (2021) Learning transferable visual models from natural language supervision. In ICML, Cited by: §4.2. [16] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer (2022) High-resolution image synthesis with latent diffusion models. In CVPR, Cited by: §4.1. [17] R. Taori et al. (2020) Measuring robustness to natural distribution shifts in image classification. In NeurIPS, Cited by: §2.3. [18] S. Wang, O. Wang, R. Zhang, A. Owens, and A. A. Efros (2020) CNN-generated images are surprisingly easy to spot… for now. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Cited by: §1, §2.1, §2.4.