Paper deep dive
Efficient Zero-Shot AI-Generated Image Detection
Ryosuke Sonoda, Ramya Srinivasan
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 98%
Last extracted: 3/26/2026, 2:31:41 AM
Summary
The paper introduces a training-free, computationally efficient method for detecting AI-generated images by measuring the sensitivity of Vision Foundation Model (VFM) representations to structured high-frequency perturbations. By utilizing a single Fourier transform and a single forward pass of a Vision Transformer (ViT), the method achieves state-of-the-art detection performance with significantly lower computational costs compared to existing training-free detectors.
Entities (7)
Relation Signals (4)
Ryosuke Sonoda → authored → Efficient Zero-Shot AI-Generated Image Detection
confidence 100% · Efficient Zero-Shot AI-Generated Image Detection Ryosuke Sonoda 1 () and Ramya Srinivasan 2
Ramya Srinivasan → authored → Efficient Zero-Shot AI-Generated Image Detection
confidence 100% · Efficient Zero-Shot AI-Generated Image Detection Ryosuke Sonoda 1 () and Ramya Srinivasan 2
Efficient Zero-Shot AI-Generated Image Detection → evaluatedon → OpenFake
confidence 100% · Extensive experiments on OpenFake [15], GenImage [35], and Semi-Truth [19] benchmarks
Efficient Zero-Shot AI-Generated Image Detection → usesmodel → CLIP
confidence 100% · We adopt the vision encoder of CLIP [21] as a feature extractor
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The rapid progress of text-to-image models has made AI-generated images increasingly realistic, posing significant challenges for accurate detection of generated content. While training-based detectors often suffer from limited generalization to unseen images, training-free approaches offer better robustness, yet struggle to capture subtle discrepancies between real and synthetic images. In this work, we propose a training-free AI-generated image detection method that measures representation sensitivity to structured frequency perturbations, enabling detection of minute manipulations. The proposed method is computationally lightweight, as perturbation generation requires only a single Fourier transform for an input image. As a result, it achieves one to two orders of magnitude faster inference than most training-free this http URL experiments on challenging benchmarks demonstrate the efficacy of our method over state-of-the-art (SoTA). In particular, on OpenFake benchmark, our method improves AUC by nearly $10\%$ compared to SoTA, while maintaining substantially lower computational cost.
Tags
Links
- Source: https://arxiv.org/abs/2603.21619v1
- Canonical: https://arxiv.org/abs/2603.21619v1
Trouble viewing inline? Open PDF directly →
Full Text
38,665 characters extracted from source content.
Expand or collapse full text
Efficient Zero-Shot AI-Generated Image Detection Ryosuke Sonoda 1 () and Ramya Srinivasan 2 1 Fujitsu Ltd., Japan sonoda.ryosuke@fujitsu.com 2 Fujitsu Research of America, Inc., USA ramya@fujitsu.com Abstract. The rapid progress of text-to-image models has made AI- generated images increasingly realistic, posing significant challenges for accurate detection of generated content. While training-based detectors often suffer from limited generalization to unseen images, training-free approaches offer better robustness, yet struggle to capture subtle dis- crepancies between real and synthetic images. In this work, we propose a training-free AI-generated image detection method that measures rep- resentation sensitivity to structured frequency perturbations, enabling detection of minute manipulations. The proposed method is computa- tionally lightweight, as perturbation generation requires only a single Fourier transform for an input image. As a result, it achieves one to two orders of magnitude faster inference than most training-free detectors. Extensive experiments on challenging benchmarks demonstrate the effi- cacy of our method over state-of-the-art (SoTA). In particular, on Open- Fake benchmark, our method improves AUC by nearly 10% compared to SoTA, while maintaining substantially lower computational cost. Keywords: Fake image detection· Zero-shot· Generative AI. 1 Introduction Rapid advancements in generative AI has brought with it both opportunities and challenges. While generative AI has ushered productivity gains across multiple sectors [20], its proliferation has also increased the chances of various types of adversarial attacks and vulnerabilities [9]. The rise of AI generated deepfakes [17], cyber espionage [2], computer network attacks [14], sockpuppet accounts [32], and comment brigading [34] are just a handful of the many ways in which generative AI is being misused by malicious players. As a consequence, a variety of counter-measures are being developed towards detecting, mitigating, and preventing mis-use of generative AI. These include development of novel defense mechanisms, regulatory and policy measures [23, 18], among others. In particular, with the emergence of text to image (T2I) and text to video (T2V) foundation models, creating fake content has become easier than ever before. Thus, a major area of focus has been in detecting AI generated content (audio, text, images, and videos) [7, 29, 1, 13, 11]. arXiv:2603.21619v1 [cs.CV] 23 Mar 2026 2R. Sonoda and R. Srinivasan Our work complements and augments aforementioned efforts in detecting AI generated content. In particular, the proposed method detects AI generated im- ages in a training-free manner across a wide range of generation processes (SoTA diffusion and GAN based methods) and image domains (e.g., politics, society news), thereby demonstrating the generalizability and robustness of detection performance and applicability. Furthermore, the proposed method is computa- tionally lightweight, achieving upto two orders of magnitude faster inference time when compared to most training-free detectors, thus making it a viable choice for deployment on edge devices. Our method is motivated by the observation that synthetic images contain frequency artifacts that cause systematically different responses in Vision Foun- dation Model (VFM) representations compared to real images. We therefore probe images using structured frequency perturbations and quantify the re- sulting representation sensitivity to distinguish real images from synthetic ones (Figure 1). Unlike prior training-free detectors that rely on large numbers of perturbed samples or repeated generative reconstruction, our method requires only a single Fourier transform and a single forward pass of an ViT, resulting in substantially lower computational cost. Extensive experiments on OpenFake [15], GenImage [35], and Semi-Truth [19] benchmarks spanning over a dozen of gener- ative models demonstrate the improvement in detection accuracy and generaliz- ability of the proposed approach over SoTA training-free detection methods [12, 3, 22, 26, 8, 30, 25]. 2 Related Work Detecting images generated by text-to-image (T2I) models has become an in- creasingly critical problem with the rapid advancement of generative models. Existing approaches for AI-generated image detection can be broadly divided into training-based and training-free methods. Training-based approaches rely on supervised learning with large-scale datasets containing both real and synthetic images, aiming to capture artifacts or biases introduced during the generation process. A line of work focuses on frequency- based cues, exploiting artificial features left by generators such as those generated by up-sampling in the frequency domain [28, 6]. Other methods utilize recon- struction errors, where models are trained to reconstruct images, and detection is performed based on reconstruction discrepancies between real and generated images [31]. With the emergence of T2I models, recent studies further explore vision–language relationship by leveraging vision-language models such as CLIP to detect inconsistencies between images and their associated text prompts [27, 24, 4]. Despite their effectiveness within the training domain, these methods often struggle to generalize to unseen generative models. In contrast, training-free methods aim to achieve zero-shot generalization without relying on labeled training data. Reconstruction-based approaches em- ploy pre-trained autoencoders or diffusion models to measure reconstruction dis- crepancies, under the assumption that real images deviate from the manifold of Efficient Zero-Shot AI-Generated Image Detection3 (a) Overall procedure of our method. 4681012 UMAP-1 0 2 4 6 8 10 12 14 UMAP-2 Original Perturbed RealReal 4681012 UMAP-1 0 2 4 6 8 10 12 14 UMAP-2 Original Perturbed FakeFake (b) UMAP visualiza- tion. Fig. 1: (a) Our method first generates a perturbed input by adding frequency- band-limited noise to each patch of the input image. These inputs are fed to Vision Transformer (ViT), then a Real/Fake classification is performed based on the distance between feature representations. (b) UMAP [16] projection of CLIP embeddings for original (blue, circle) and perturbed (orange, cross) im- ages. The top panel corresponds to real images, and the bottom corresponds to fake (generated) images. As can be observed, real data exhibits distinct regions of original and perturbed images as opposed to fake data. For visualization pur- poses, we randomly sub-sampled 1,000 samples from OpenFake dataset generators [22, 12, 3]. Also, adversarial text-driven reconstruction methods in- corporate T2I generation priors to enable training-free detection [25]. Another line of work focuses on frequency-based analysis, where high-frequency com- ponents are used to identify statistical anomalies in generated images [5, 33]. Perturbation-based methods further assess the robustness of image representa- tions under controlled perturbations, often leveraging large pre-trained vision models to expose representation instability in real images [8, 30]. Our approach follows the training-free paradigm but differs from existing methods by considering structured frequency-specific perturbations and seman- tic representations from a vision-language foundation model. By considering the sensitivity of the model to structured high-frequency perturbations, our method captures fine-grained discrepancies at a much lower computational cost com- pared to most SoTA training-free methods. 3 Method We aim to distinguish real images from synthetic ones by probing their response to structured high-frequency perturbations. In a training-free setting, we define 4R. Sonoda and R. Srinivasan a score function that quantifies the sensitivity of VFM representations to con- trolled perturbations in the frequency domain (Section 3.1). We adopt the vision encoder of CLIP [21] as a feature extractor and keep its parameters fixed during inference, while the choice of representation layer is detailed in Section 3.2. 3.1 AI-generated Image Detection We propose to detect AI-generated images by analyzing their sensitivity of vi- sual representations to structured high-frequency perturbations. Our underlying hypothesis is that compared to real images, synthetic images exhibit charac- teristic frequency biases induced by generator architectures and training data distribution, which may lead to different responses under targeted frequency perturbations. Given an input image x∈R H×W×C , we construct a frequency perturbation δ restricted to the high-frequency band in the Fourier domain. Specifically, we sample Gaussian noise ε ∼ N(0,λI) where λ > 0 controls the perturbation strength in the pixel space, transform it using the fast Fourier transform (FFT), suppress its low-frequency components, and then invert it back to obtain a high- frequency perturbation δ. The perturbed image is defined as ̃x = x + δ.(1) We define high-frequency components as the Fourier coefficients whose radial frequency exceeds a threshold τ in the normalized frequency domain. Unlike real images, whose high-frequency components encode diverse details, generated images often inherit frequency biases induced by generator priors and training objectives. Consequently, perturbations along high-frequency directions are ex- pected to alter real images more substantially. To control the spatial scale of perturbations, we optionally partition the image into non-overlapping patches of size P×P and apply the above frequency perturbation independently within each patch. Let x∈R H×W×C be partitioned into N non-overlapping patchesx i N i=1 of spatial size P×P, where N = H P × W P . For each patch x i , we independently construct a high-frequency perturbation δ i using the procedure described above, and obtain the perturbed patch ̃x i = x i + δ i . The final perturbed image ̃x is reconstructed by assembling all ̃x i . This formulation allows the spatial correlation length of perturbations to be controlled via the patch size P. Let f(·) denote the embedding function of a fixed pre-trained VFM. We define the detection score S(x) as the cosine similarity between the embeddings of the original and perturbed images: S(x) = SIM f(x),f( ̃x) ,(2) where SIM(·,·) is the cosine similarity. A higher score indicates that the image representation is invariant to struc- tured high-frequency perturbations. Based on our hypothesis, AI-generated im- ages tend to yield higher similarity scores due to their constrained high-frequency characteristics, whereas real images exhibit larger representation shifts. Efficient Zero-Shot AI-Generated Image Detection5 3.2 Layer-wise Representation Choice A common approach for image representation in CLIP [21] is to use the final layer’s output embedding, which is highly effective for semantic alignment but often suboptimal for detecting subtle visual discrepancies. CLIP employs a hi- erarchical structure: shallow layers capture low-level features (edges, textures), while deeper layers progressively abstract to high-level semantic concepts. The final layer’s CLS token is explicitly optimized to be invariant to fine-grained appearance variations that do not alter the core semantic meaning. However, our detection framework relies on structured high-frequency pertur- bations, which predominantly affect fine-scale image details while largely preserv- ing global semantics. Therefore, representations that overly emphasize semantic invariance may suppress the signal induced by our perturbation strategy. To address this mismatch, we extract image representations from an in- termediate layer l of CLIP. Compared to the final embedding, intermediate- layer features retain finer-grained visual cues while preserving sufficient seman- tic structure, making them better suited for capturing representation shifts in- duced by high-frequency perturbations. Unless otherwise stated, we therefore use intermediate-layer CLIP embeddings for computing the similarity score in Eq. (2). We also discuss performance differences across each layer in our ablation study. 3.3 Computational Complexity Several training-free detection methods follow a common paradigm: they gener- ate perturbed versions of the input image, feed both the original and perturbed images into a VFM, and compute discrepancies in the VFM feature space. Ac- cordingly, their computational cost is primarily determined by (i) the cost of generating perturbed samples and (i) the cost of VFM forward passes. Let C VFM denote the cost of a single VFM forward pass. In our method, perturbation generation requires one 2D FFT and inverse FFT, resulting in O(HW log(HW)) complexity, followed by a single backbone inference. The over- all complexity is therefore O(HW log(HW)) + C VFM . In practice, the cost is dominated by a single backbone forward pass. In contrast, methods such as WARPAD [26] evaluate K perturbed samples per image, requiring K forward passes per input. Approaches requiring recon- struction of the input image [22, 25, 3, 5, 12] necessitate multiple invocations of generative models, further increasing computational overhead. These structural differences account for the runtime gap reported in Section 4.2. 4 Experiments We first introduce the datasets, generative models and the baseline methods con- sidered in our analysis (Section 4.1). We report the performance of our method across these datasets (Section 4.2). Finally, we present detailed ablation studies of our method and test its robustness across data corruptions (Section 4.3). 6R. Sonoda and R. Srinivasan Table 1: Statistics of datasets in our experiments. Dataset # of Generators # of Real # of Generated Openfake342982929829 GenImage85000050000 Semi-Truth5696726786 4.1 Experimental Settings Datasets: We evaluate our method on several widely used datasets for AI- generated image detection, covering diverse generative models, image domains, and evaluation settings. Specifically, we conduct experiments on OpenFake 3 [15], GenImage 4 [35], and Semi-Truth 5 [19] which provide large-scale test sets gener- ated by a wide range of diffusion- and GAN-based models, enabling comprehen- sive evaluation across heterogeneous generation processes. We adopt the official test split provided by the dataset, and no training data is used, as all compared methods are entirely training-free. For Semi-Truth dataset, samples with miss- ing labels or corrupted image files were excluded to ensure evaluation integrity. Table 1 summarizes the key statistics of the datasets used in our experiments, including the number of generative models and test images. The three datasets differ substantially in the number of generative models em- ployed. Semi-Truth contains images generated by a limited set of diffusion-based models, including Kandinsky 2.2, OpenJourney, and Stable Diffusion variants. GenImage further expands generator diversity, including diffusion and GAN- based architectures such as ADM, BigGAN, Glide, VQDM, Wukong, Midjour- ney, and Stable Diffusion, resulting in substantial heterogeneity across generative paradigms. OpenFake includes images synthesized by a large number of gener- ators, spanning both commercial and open-source systems, making it the most diverse and challenging dataset in terms of generator coverage. This variation in generator composition enables evaluation under heterogeneous generative distri- butions and differing levels of model diversity. Evaluation Metrics: Following prior work on training-free AI-generated image detection, we report detection performance using the Area Under the Receiver Operating Characteristic curve (AUC), which is threshold-independent.We also report on the runtime to analyze the computational efficacy of various methods. Baselines: We compare our method with a broad set of SoTA training-free detectors. These baselines span multiple methodological categories, including reconstruction-based methods (AEROBLADE [22], DTAD [12], MIBD [3], ZE- ROFAKE [25]), frequency-based detectors (HFI [5], WARPAD [26]), perturbation- based methods (RIGID [8], MINDER [30]). All baseline results are obtained using official implementations or reported settings to ensure fair comparison. 3 https://huggingface.co/datasets/ComplexDataLab/OpenFake 4 https://github.com/GenImage-Dataset/GenImage 5 https://huggingface.co/datasets/semi-truths/Semi-Truths-Evalset Efficient Zero-Shot AI-Generated Image Detection7 Implementation Details: In our method, all input images are resized to 224× 224 as we use CLIP ViT-L/14 6 as the vision foundation model. For local- ized frequency perturbation, we divide each image into N = 16 non-overlapping patches with patch-size P = 14. We extract CLS embeddings from an interme- diate transformer layer l = 13 of CLIP ViT. The high-frequency threshold is set to τ = 0.5. All methods are implemented in PyTorch, and experiments are conducted on a single NVIDIA A100 GPU. The batch-size is fixed at 8 for all experiments, and the random seed is also fixed for reproducibility. 4.2 Main Results Tables 2, 3, and 4 summarize the performance of our method against existing training-free approaches on the OpenFake, Semi-Truth, and GenImage datasets. Across all three datasets, our method consistently achieves the highest average AUC. In particular, we observe an average AUC improvement of 10% over the DTAD on openfake, with gains of up to 14% on Semi-Truth. Unlike competing methods, whose performance varies substantially across datasets, our approach maintains stable performance under diverse generative settings. These results indicate that our method generalizes robustly across datasets with different gen- eration sources and distributional characteristics. We additionally report ROC curves on the Openfake, Semi-Truth, and GenImage datasets in Figure 2. The ROC curves show that our method consistently outperforms existing approaches across a broad range of false-positive rates, indicating robustness against distri- butional shifts. Figure 3 shows the average AUC scores versus inference runtime of each method on three datasets, measured on a single NVIDIA A100 GPU. The corre- sponding numerical values of runtime are provided in Table 5 for completeness and reproducibility. Runtime is computed from model input to prediction output, excluding image preprocessing with a mini-batch size of 8. Our method achieves the lowest computational cost among all compared approaches, providing one to two orders of magnitude faster inference than prior SoTA methods. Com- pared to RIGID—the second fastest method—our approach is over 2× faster while simultaneously achieving substantially higher detection performance, with an AUC improvement of approximately 40% on OpenFake. The runtime gap between RIGID and our method appears to stem primarily from differences in backbone inference speed, as RIGID employs a relatively simple perturbation design. Compared to other training-free baselines, our method remains signifi- cantly more efficient. Although WARPAD and DTAD attain competitive AUC scores, their computational overhead is significantly higher, being tens to hun- dreds of times slower than our method. This inefficiency stems from large-scale perturbed-sample evaluation in WARPAD and iterative noise sampling with re- peated denoising steps in DTAD. Overall, these results demonstrate that our method achieves competitive de- tection performance while maintaining computational efficiency. 6 https://huggingface.co/openai/clip-vit-large-patch14 8R. Sonoda and R. Srinivasan Table 2: AUC scores of all methods evaluated on the OpenFake dataset. Rows correspond to image generators, columns to detection methods, and the final row reports the average AUC across generators. The best results are highlighted in bold. GeneratorRIGID MINDER AERO BLADE MIBD ZERO FAKE DTAD WAR PAD HFI OURS Aurora-20-1-250.473 0.471 0.343 0.788 0.684 0.228 0.420 0.487 0.850 Chroma0.633 0.633 0.452 0.503 0.571 0.924 0.728 0.432 0.879 DALLE-30.469 0.468 0.311 0.572 0.560 0.386 0.525 0.354 0.858 Flux-1.1-pro0.434 0.434 0.531 0.445 0.605 0.485 0.567 0.527 0.808 Flux-amateur snapshotphotos 0.506 0.505 0.559 0.460 0.502 0.934 0.627 0.498 0.797 Flux-mvc50000.371 0.371 0.560 0.501 0.543 0.772 0.381 0.476 0.857 Flux-realism0.548 0.547 0.430 0.488 0.719 0.909 0.608 0.415 0.814 Flux.1-dev0.558 0.557 0.489 0.481 0.694 0.942 0.627 0.522 0.790 Flux.1-schnell0.577 0.575 0.591 0.485 0.633 0.948 0.724 0.595 0.836 Frames-23-1-250.440 0.438 0.340 0.832 0.550 0.900 0.660 0.376 0.860 GPT-image-10.512 0.510 0.358 0.548 0.675 0.700 0.543 0.400 0.857 Grok-2-image-1212 0.503 0.501 0.446 0.474 0.694 0.396 0.298 0.516 0.700 Halfmoon-4-4-25 0.546 0.544 0.422 0.855 0.438 0.868 0.750 0.459 0.847 Hidream-i1-full0.552 0.554 0.521 0.539 0.541 0.918 0.690 0.487 0.866 Ideogram-2.00.486 0.484 0.390 0.809 0.485 0.852 0.713 0.382 0.901 Ideogram-3.00.591 0.589 0.389 0.478 0.391 0.932 0.685 0.489 0.897 Imagen-3.0-0020.442 0.440 0.313 0.462 0.490 0.845 0.517 0.379 0.930 Imagen-4.00.467 0.465 0.410 0.419 0.501 0.790 0.572 0.384 0.918 Lumina-17-2-250.620 0.623 0.591 0.844 0.683 0.928 0.744 0.570 0.897 Midjourney-60.435 0.433 0.260 0.792 0.447 0.315 0.504 0.327 0.766 Midjourney-70.636 0.635 0.236 0.740 0.627 0.872 0.723 0.449 0.877 Mystic0.645 0.644 0.468 0.486 0.645 0.908 0.687 0.326 0.915 Recraft-v20.322 0.319 0.396 0.748 0.504 0.707 0.668 0.328 0.960 Recraft-v30.394 0.391 0.308 0.821 0.730 0.623 0.764 0.282 0.958 SD1.50.524 0.537 0.267 0.847 0.297 0.684 0.792 0.336 0.952 SD1.5-dream shaper 0.721 0.720 0.190 0.663 0.468 0.764 0.745 0.259 0.885 SD1.5-epicdream 0.523 0.521 0.257 0.594 0.708 0.758 0.723 0.260 0.907 SD2.10.724 0.728 0.375 0.865 0.522 0.871 0.842 0.418 0.947 SD3.50.490 0.488 0.511 0.568 0.471 0.956 0.733 0.375 0.904 SDXL0.695 0.694 0.410 0.646 0.681 0.895 0.838 0.355 0.924 SDXL-epic-realism 0.516 0.515 0.202 0.579 0.673 0.800 0.689 0.289 0.973 SDXL-juggernaut 0.492 0.492 0.367 0.521 0.633 0.908 0.683 0.380 0.951 SDXL-realvis-v5 0.434 0.433 0.326 0.607 0.431 0.754 0.803 0.301 0.923 SDXL-touchof realism 0.689 0.688 0.272 0.610 0.781 0.853 0.802 0.298 0.931 Average0.536 0.536 0.389 0.593 0.580 0.779 0.658 0.401 0.881 Efficient Zero-Shot AI-Generated Image Detection9 Table 3: AUC scores of all methods evaluated on the Semi-Truth dataset. Generator RIGID MINDER AERO BLADE MIBD ZERO FAKE DTAD WAR PAD HFI OURS Kandinsky22 0.450 0.451 0.723 0.548 0.507 0.829 0.852 0.606 0.844 OpenJourney 0.498 0.498 0.707 0.499 0.562 0.649 0.680 0.700 0.801 SDXL0.352 0.352 0.531 0.482 0.525 0.686 0.805 0.659 0.834 SD1.40.350 0.351 0.686 0.525 0.679 0.730 0.750 0.975 0.872 SD1.50.447 0.448 0.724 0.530 0.668 0.780 0.785 0.967 0.854 Average0.418 0.419 0.671 0.517 0.583 0.736 0.779 0.771 0.841 Table 4: AUC scores of all methods evaluated on the Genimage dataset. Generator RIGID MINDER AERO BLADE MIBD ZERO FAKE DTAD WAR PAD HFI OURS ADM0.845 0.850 0.690 0.754 0.918 0.935 0.989 0.759 0.974 BigGAN 0.961 0.961 0.839 0.942 0.901 0.973 0.999 0.950 0.886 Glide0.901 0.900 0.760 0.876 0.924 0.968 0.992 0.863 0.979 Midjourney 0.684 0.681 0.595 0.565 0.781 0.923 0.840 0.576 0.972 SD1.40.603 0.606 0.835 0.717 0.904 0.950 0.955 0.937 0.991 SD1.50.596 0.600 0.833 0.720 0.907 0.949 0.950 0.943 0.991 VQDM0.911 0.918 0.600 0.901 0.794 0.918 0.986 0.693 0.985 Wukong0.630 0.643 0.870 0.704 0.837 0.935 0.941 0.959 0.992 Average0.760 0.763 0.756 0.770 0.873 0.944 0.956 0.839 0.972 Table 5: Total inference runtime (in seconds) with a batch size of 8. MethodOpenfake Semi-Truth Genimage RIGID1519.485860.4922550.385 MINDER3019.285 1707.962 5055.123 AEROBLADE 11042.416 6246.216 18476.045 MIBD75610.938 42668.291 126113.634 ZEROFAKE 2095768.396 1184961.851 3510376.209 DTAD276861.686 156680.426 463905.786 WARPAD19933.757 11283.683 33435.179 HFI6568.457 3710.264 11053.292 OURS436.752190.816559.813 10R. Sonoda and R. Srinivasan (a) Openfake dataset.(b) Semi-Truth dataset.(c) Genimage dataset. Fig. 2: ROC curves for the Openfake, Semi-Truth, and Genimage dataset. (a) Openfake dataset.(b) Semi-Truth dataset.(c) Genimage dataset. Fig. 3: Average AUC versus total inference runtime (batch size = 8). Higher AUC and lower runtime are preferred; points closer to the upper-left corner indicate better accuracy-speed performance. 4.3 Ablation Studies For a deeper analysis of the proposed method, we investigate the robustness to image corruption, the impact of hyperparameters, and the influence of different vision models. Robustness to Corruptions Robustness to post-processing artifacts is critical for synthetic image detec- tion, as images shared on real-world platforms are frequently subject to com- pression, resizing, and other degradations that alter low-level statistics. To as- sess robustness under such distribution shifts, we evaluate performance under four common perturbations: Gaussian blur, Gaussian noise, center cropping, and JPEG compression. We do not conduct ablation studies for ZEROFAKE [25] due Efficient Zero-Shot AI-Generated Image Detection11 to its substantially higher computational cost (Table 5), which makes repeated evaluations impractical under our experimental setup. Experiments are conducted on the OpenFake dataset, where each perturba- tion is applied at three increasing intensity levels. Figure 4 reports the overall AUC for each perturbation. Existing methods are often affected by perturba- tions, thus reducing their performances. For example, DTAD exhibits substantial degradation under JPEG compression, with performance approaching random classifier at higher compression levels. Other representative methods show unsta- ble behavior across perturbation types, with AUC frequently dropping below 0.5, indicating limited robustness to distributional corruption. Our method demon- strates stable performance across most perturbations. Although Gaussian noise and JPEG compression leads to a noticeable decline in detection accuracy when the intensity increases, the overall degradation remains moderate. Across all perturbation types and intensity levels, our method achieves the highest average AUC, indicating superior robustness under realistic image degradation scenarios. Hyperparameter Analysis We analyze the sensitivity of our method to its key hyperparameters, includ- ing noise strength λ, the patch-size P, and the selected CLIP layer l. Figure 5a examines the effect of the noise magnitude λ on the OpenFake dataset. Excessive noise levels (λ = 1.0 and 0.1) lead to a clear degradation in AUC, indicating that overly strong perturbations distort discriminative cues necessary for detection. Performance peaks at λ = 0.01, with further reduction in noise strength resulting in only marginal decline. This suggests the existence of an optimal perturbation scale that maximizes discriminative sensitivity, whereas excessive noise distorts image statistics and reduces discriminative cues. Figure 5b evaluates the impact of patch granularity. We observe that de- tection performance varies with the spatial granularity of perturbation. Ex- tremely fine-grained (pixel-wise) perturbations degrade performance (P = 1), whereas intermediate-to-global perturbations yield stronger discriminative re- sponses. This suggests that synthetic artifacts manifest at intermediate-to-global frequency scales rather than at purely local structures. We further investigate the influence of the selected CLIP ViT layer l. Fea- tures extracted from different layers exhibit distinct representational properties. Shallow layers primarily encode low-level texture statistics, while deeper layers capture high-level semantic abstractions [10]. As shown in Figure 5c, shallow layers yield AUC values close to random performance, suggesting that purely low-level cues are insufficient for reliable discrimination. Conversely, the deepest layers also produce suboptimal performance, implying that high-level seman- tic representations alone do not capture the artifacts introduced by generative models. The best performance is achieved around layer 13, indicating that inter- mediate representations provide the most discriminative signal. This observation suggests that synthetic artifacts are encoded in mid-level features, which balance structural and frequency-sensitive information. 12R. Sonoda and R. Srinivasan (a) Gaussian Blur(b) Gaussian Noise (c) JPEG Compression(d) Crop Fig. 4: Robustness evaluation across common perturbations, measured in AUC. Efficient Zero-Shot AI-Generated Image Detection13 (a) Noise strength λ(b) Patch size P(c) CLS layer l Fig. 5: Hyperparameter analysis of our method w.r.t. AUC result on Openfake dataset. Table 6: Proposed method’s performance (AUC) and runtime in the Openfake dataset under different backbones. For each model, we extract the feature rep- resentations from the layer with the highest AUC. ModelAUC Runtime CLIP-B/32 (Layer 8) 0.7652 245.3 DINOv2 (Layer 14) 0.6795 1437.6 DINOv3 (Layer 6) 0.5019 1172.4 CLIP-L/14 (Layer 13) 0.881 436.8 Effect of models Table 6 reports the impact of different vision foundation models on detection performance. We first evaluate the smaller variant of CLIP model (ViT-B/32 7 ), which achieves improved inference speed compared to ViT-L/14 but its detection accu- racy on OpenFake is lower. This suggests that our method benefits from higher- capacity representations, which better capture the subtle frequency discrepancies exploited by our perturbation strategy. We further investigate self-supervised vi- sion foundation models, including DINOv2 8 and DINOv3 9 . Both models yield substantially lower performance than CLIP-based variants. A plausible expla- nation is that their training paradigm emphasizes robustness and invariance to local perturbations, which may suppress sensitivity to the fine-grained frequency artifacts essential for distinguishing synthetic images from natural ones. We also observe a consistent runtime difference between CLIP models and DINO models under the same experimental setting. 7 https://huggingface.co/openai/clip-vit-base-patch32 8 https://huggingface.co/facebook/dinov2-large 9 https://huggingface.co/facebook/dinov3-vits16-pretrain-lvd1689m 14R. Sonoda and R. Srinivasan 5 Conclusion We presented a training-free method for AI-generated image detection that exploits structured high-frequency perturbations and semantic representations from vision-language foundation models. By measuring representation sensitivity at an intermediate layer, our approach effectively captures fine-grained discrep- ancies between real and generated images that are often overlooked in exist- ing training-free detectors. Extensive experiments demonstrate that our method achieves improved detection accuracy and robustness across diverse benchmarks and generative models, while requiring no additional training or model adap- tation. Owing to its lightweight perturbation design, the proposed approach is computationally efficient and readily scalable to real-world deployment. Limitations and Future Work Our current evaluation focuses on ranking performance. Future work will investigate how to determine an appropriate decision threshold for practical deployment settings. Moreover, the current framework relies on a fixed fre- quency decomposition; exploring adaptive frequency representations may fur- ther improve robustness. Finally, extending the approach to incorporate cross- modal consistency signals, such as text-image alignment, could enhance resilience against increasingly sophisticated generative models. References 1. Alam, I., Islam, M., Woo, S.: Specxnet: A dual-domain convolutional network for robust deepfake detection. ACM M (2025) 2. Anthropic:Disruptingthefirstreportedai-orchestrated cyberespionagecampaign(RetrievedDecember2025), https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first- reported-AI-orchestrated-cyber-espionage-campaign.pdf 3. Brokman, J., Giloni, A., Hofman, O., Vainshtein, R., Kojima, H., Gilboa, G.: Man- ifold induced biases for zero-shot and few-shot detection of generated images. arXiv preprint arXiv:2504.15470 (2025) 4. Cazenavette, G., Sud, A., Leung, T., Usman, B.: Fakeinversion: Learning to detect images from unseen text-to-image models by inverting stable diffusion. In: Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. p. 10759–10769 (2024) 5. Choi, S., Park, S., Lee, J., Kim, S., Choi, S.J., Lee, M.: Hfi: A unified framework for training-free detection and implicit watermarking of latent diffusion model gen- erated images. arXiv (2024) 6. Chu, B., Xu, X., Wang, X., Zhang, Y., You, W., Zhou, L.: Fire: Robust detection of diffusion-generated images via frequency-guided reconstruction error. In: Proceed- ings of the Computer Vision and Pattern Recognition Conference. p. 12830–12839 (2025) 7. Cui, J., Yu, B., Wang, Q., Meng, F., Lu, J.: Whiadd: Semantic-acoustic fusion for robust audio deepfake detection. ACM M (2025) 8. He, Z., Chen, P.Y., Ho, T.Y.: Rigid: A training-free and model-agnostic framework for robust ai-generated image detection. arXiv (2024) Efficient Zero-Shot AI-Generated Image Detection15 9. Jaidka, K., et al.: Misinformation, disinformation, and generative ai: Implications for perception and policy. Digital Government: Research and Practice (2024) 10. Jiang, D., Liu, Y., Liu, S., Zhao, J., Zhang, H., Gao, Z., Zhang, X., Li, J., Xiong, H.: From clip to dino: Visual encoders shout in multi-modal large language models. arXiv preprint arXiv:2310.08825 (2023) 11. Li, Z., et al.: Is artificial intelligence generated image detection a solved problem? NeurIPS (2025) 12. Liang, Y., Yu, M., Li, G., Jiang, J., Du, F., Li, J., Xie, L., Xu, Z., Huang, W.: De- noising trajectory biases for zero-shot ai-generated image detection. In: Advances in Neural Information Processing Systems (2025) 13. Lin, K., et al.: Guard me if you know me: Protecting specific face-identity from deepfakes. NeurIPS (2025) 14. Liu, B.: Network security issues caused by generative artificial intelligence. ICADI 2024: Proceedings of the 2024 International Conference on Artificial Intelligence, Digital Media Technology and Interaction Design (2024) 15. Livernoche, V., Arodi, A., Musulan, A., Yang, Z., Salvail, A., Caron, G.M., God- bout, J.F., Rabbany, R.: Openfake: An open dataset and platform toward real- world deepfake detection. arXiv preprint arXiv:2509.09495 (2025) 16. McInnes, L., Healy, J., Melville, J.: Umap: Uniform manifold approximation and projection for dimension reduction. ArXiv (2018) 17. Mirsky, Y., Lee, W.: The creation and detection of deepfakes: A survey. ACM Computing Surveys (2021) 18. Naffi, N.: Deepfakes and the crisis of knowing (Retrieved December 2025), https://w.unesco.org/en/articles/deepfakes-and-crisis-knowing 19. Pal, A., Kruk, J., Phute, M., Bhattaram, M., Yang, D., Chau, D.H., Hoffman, J.: Semi-truths: A large-scale dataset of ai-augmented images for evaluating robust- ness of ai-generated image detectors. Advances in Neural Information Processing Systems 37, 118025–118051 (2024) 20. Park, J.S., O’Brien, J.C., Cai, C.J., Morris, M.R., Liang, P., Bernstein, M.S.: Gen- erative agents: Interactive simulacra of human behavior. UIST (2023) 21. Radford, A., Kim, J.W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al.: Learning transferable visual models from natural language supervision. In: International conference on machine learning. p. 8748–8763. PmLR (2021) 22. Ricker, J., Lukovnikov, D., Fischer, A.: Aeroblade: Training-free detection of latent diffusion images using autoencoder reconstruction error. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. p. 9130– 9140 (2024) 23. of Scientific American, E.: We need laws to stop ai-generated deepfakes (Retrieved December 2025), https://w.scientificamerican.com/article/we-need- laws-to-stop-ai-generated-deepfakes/ 24. Sha, Z., Li, Z., Yu, N., Zhang, Y.: De-fake: Detection and attribution of fake images generated by text-to-image generation models. In: Proceedings of the 2023 ACM SIGSAC conference on computer and communications security. p. 3418– 3432 (2023) 25. Sha, Z., Tan, Y., Li, M., Backes, M., Zhang, Y.: Zerofake: Zero-shot detection of fake images generated and edited by text-to-image generation models. In: Proceed- ings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. p. 4852–4866 (2024) 16R. Sonoda and R. Srinivasan 26. Sungik Choi, Hankook Lee, M.L.: Training-free detection of ai-generated images via cropping robustness. In: Advances in Neural Information Processing Systems (2025) 27. Tan, C., Tao, R., Liu, H., Gu, G., Wu, B., Zhao, Y., Wei, Y.: C2p-clip: Injecting category common prompt in clip to enhance generalization in deepfake detection. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 39, p. 7184–7192 (2025) 28. Tan, C., Zhao, Y., Wei, S., Gu, G., Liu, P., Wei, Y.: Rethinking the upsampling operations in cnn-based generative network for generalizable deepfake detection. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). p. 28130–28139 (2024) 29. Tong, Y., Lu, W., Cui, X., Mao, Y., Zhao, Z.: Dapt: Domain-aware prompt-tuning for multimodal fake new detection. ACM M (2025) 30. Tsai, C.T., Ko, C.Y., Chung, I., Wang, Y.C.F., Chen, P.Y., et al.: Understanding and improving training-free ai-generated image detections with vision foundation models. arXiv preprint arXiv:2411.19117 (2024) 31. Wang, Z., Bao, J., Zhou, W., Wang, W., Hu, H., Chen, H., Li, H.: Dire for diffusion- generated image detection. In: Proceedings of the IEEE/CVF International Con- ference on Computer Vision. p. 22445–22455 (2023) 32. Yang, K.C., Singh, D., Menczer, F.: Characteristics and prevalence of fake social media profiles with ai-generated faces. Journal of online Trust and Safety (2024) 33. Zhou, H., Deng, Y., Wang, H.: Rethinking perturbation-based training-free method for deepfake face detection. In: 2024 5th International Conference on Computers and Artificial Intelligence Technology (CAIT). p. 1–5. IEEE (2024) 34. Zhou, J., et al.: Synthetic lies: Understanding ai-generated misinformation and evaluating algorithmic and human solutions. ACM CHI (2023) 35. Zhu, M., Chen, H., Yan, Q., Huang, X., Lin, G., Li, W., Tu, Z., Hu, H., Hu, J., Wang, Y.: Genimage: A million-scale benchmark for detecting ai-generated image. Advances in Neural Information Processing Systems 36, 77771–77782 (2023)