Minimalist Preprocessing Approach for Image Synthesis Detection

Source: arXiv:2606.25297 · Published 2026-06-24 · By Hoai-Danh Vo, Trung-Nghia Le

TL;DR

This paper addresses the challenge of detecting AI-generated synthetic images, particularly under the constraints of low-resource environments such as smartphones. The authors introduce a minimalist preprocessing technique called the Adjacency Difference Orientation Filter (ADOF), which calculates pixel intensity gradients between neighboring pixels to capture subtle noise and textural variations characteristic of synthetic images. This gradient-based approach works as a high-pass filter to emphasize structural features while suppressing color information, simplifying the input for lightweight convolutional neural networks. Through experiments on multiple benchmark datasets including ForenSynths, Self-Synthesis 9 GANs, DiffusionForensics, and the Ojha test sets, the proposed ADOF method achieves detection accuracy comparable or superior to several state-of-the-art detection approaches, despite vastly reduced model complexity and computational demands. The method attains accuracies up to 98.3% on DiffusionForensics and 94.9% on Ojha. Its parameter count and FLOPs are orders of magnitude smaller than many deep learning baselines, demonstrating suitability for deployment on mobile or low-powered devices.

Key findings

• ADOF achieves 94.2% accuracy on the Self-Synthesis 9 GANs dataset, surpassing the prior best Ojha method at 77.6% and NPR at 93.2%.
• On DiffusionForensics, ADOF reaches 98.3% accuracy, outperforming NPR at 95.3% and DIRE (trained on this dataset) at 97.9%.
• On the Ojha test set, ADOF obtains 94.9% accuracy, exceeding both RINE (91.1%) and Ojha (86.9%).
• ADOF reduces model parameters to 1.44 million vs 25.56 million (LGrad) and 427.62 million (Ojha), reducing computational load by over 97.8% compared to RINE and 57.8% versus LGrad.
• Inference time per image is 0.40 ms on RTX A4000 GPU for ADOF versus 4.81 ms for LGrad and 29.19 ms for Ojha.
• The filtering step excludes gradient angles near ±π/2 (strong edges) improving detection accuracy.
• Training utilized only 4 of 20 classes in ForenSynths dataset demonstrating generalization to unseen classes and models.
• ADOF’s lightweight CNN is based on a trimmed and modified ResNet50 with conv1 kernel reduced to 3×3 for capturing 8-connected pixel neighborhoods.

Threat model

The adversary generates synthetic images using various GAN or diffusion models intending to deceive automated detectors, particularly on low-powered devices such as smartphones. The attacker does not have access to or the ability to manipulate the proposed detector's preprocessing steps or internal parameters, nor to mount targeted adversarial perturbations. The defense is designed to detect generic synthetic images across multiple generation architectures.

Methodology — deep read

The threat model assumes an adversary generating synthetic images using popular GAN or diffusion models, aiming to deceive detectors on resource-constrained devices. The adversary does not have access to detector internals or ability to manipulate the preprocessing step.

Data provenance involves training on the ForenSynths dataset, which contains 20 object classes from LSUN with corresponding synthetic images generated by ProGAN. The training subset consists of 4 classes (car, cat, chair, horse), aligning with protocols from prior works to test generalization. Evaluation is performed on multiple datasets: Self-Synthesis 9 GANs consisting of 36,000 images from LSUN, ImageNet, CelebA, and FaceForensics++ generated by 9 GAN variants; DiffusionForensics with 40,000 images generated by diffusion models ADM, DDPM, etc.; and the Ojha test set of 16,000 images from LAION and ImageNet generated by ADM, Glide, DALL-E Mini, and LDM. These datasets are designed to test cross-model and cross-domain generalization.

Algorithmically, the key novelty is the Adjacency Difference Orientation Filter (ADOF), which computes the gradient of pixel intensity differences between adjacent pixels in x and y directions using finite differences: Dx(x, y) = I(x+1, y) - I(x, y) and Dy(x, y) = I(x, y+1) - I(x, y). The gradient magnitude Gm and orientation Go (arctan(Dy/Dx)) are calculated per pixel, generating a high-pass filtered grayscale map emphasizing local pixel fluctuations. To reduce noise from strong edges, gradient orientations near ±π/2 are zeroed out.

This filtered output is fed into a lightweight CNN based on ResNet50 with layers 3 and 4 removed and first conv kernel size reduced from 7×7 to 3×3 to focus on local neighborhood patterns effectively. The model learns to distinguish subtle noise and correlation patterns more prominent in synthetic images caused by neural network upsampling.

Training uses the Adam optimizer with learning rate 2e-4, batch size 32, and learning rate decay every 5 epochs on an Nvidia RTX A4000 GPU with AMD Ryzen 5 5600X CPU. The training uses open source code from NPR [34] as baseline for consistency. Approximately 20 epochs is implied by the decay schedule. Hyperparameters match existing work.

Evaluation metrics include accuracy (ACC) and average precision (AP) across datasets and individual GAN/model classes. Baselines compared include 10 state-of-the-art detectors such as CNNDetection, Frank, Durall, Patchfor, F3Net, SelfBland, GANDetection, LGrad, Ojha, NPR, and DIRE. Computational costs measured include number of parameters, FLOPs (using fvcore), input preprocessing time, and inference time.

Reproducibility is supported by code release at https://github.com/vohoaidanh/adof. The datasets used are publicly referenced in literature but some (ForenSynths) may require access permissions. Frozen weights are not stated explicitly. The methodology section clearly describes the preprocessing filter and model architecture for replication. However, exact training epoch counts are unclear, and distribution shift robustness tests beyond chosen datasets are not reported.

An example workflow: an input image is converted to grayscale, filtered by ADOF computing Dx, Dy gradient maps, orientation angles near vertical/horizontal edges suppressed, producing a grayscale gradient magnitude map emphasizing local high-frequency noise patterns. This map feeds into the trimmed ResNet CNN that outputs a binary real vs synthetic prediction. Training on ForenSynths subset teaches the model to detect correlated pixel noise artifacts common with GAN or diffusion generated imagery. Evaluation on unseen datasets gauges generalization. The low computational profile enables deployment on mobile devices.

Technical innovations

• Introduction of the Adjacency Difference Orientation Filter (ADOF), a simple pixel-level gradient filter that captures local intensity variations and acts as a high-pass filter to emphasize synthetic image artifacts while reducing color influence.
• Modification of ResNet50 by removing deeper layers and reducing initial convolution kernel size to 3×3 to create a lightweight CNN suited for processing ADOF-filtered images.
• Disabling gradient orientations near ±π/2 to exclude strong edge regions, improving model accuracy by focusing on relevant flat regions with subtle noise differences.
• Demonstration that minimalist preprocessing combined with a lightweight model can drastically reduce computational complexity (parameters, FLOPs) compared to heavy transformer or large CNN-based detectors while maintaining or improving detection accuracy.

Datasets

• ForenSynths — ~72,000 images (18,000 real + synthetic per 4 selected classes) — Derived from LSUN and ProGAN
• Self-Synthesis 9 GANs — 36,000 images — Public benchmarks from LSUN, ImageNet, CelebA, FaceForensics++ with 9 GAN generators
• DiffusionForensics — 40,000 images — From LSUN and ImageNet with diffusion models ADM, DDPM, etc.
• Ojha test set — 16,000 images — From LAION, ImageNet with ADM, Glide, DALL-E Mini, LDM

Baselines vs proposed

• Ojha [28]: Accuracy = 77.6% vs ADOF: 94.2% on Self-Synthesis 9 GANs
• NPR [34]: Accuracy = 93.2% vs ADOF: 94.2% on Self-Synthesis 9 GANs
• DIRE [37]: Accuracy = 97.9% vs ADOF: 98.3% on DiffusionForensics (trained on same dataset)
• RINE [21]: Accuracy = 91.1% vs ADOF: 94.9% on Ojha test set
• LGrad [35]: Accuracy = 88.2% vs ADOF: 98.3% on DiffusionForensics
• Ojha [28]: Parameters = 427.62M vs ADOF: 1.44M (97.8% reduction)
• LGrad [35]: FLOPs = 4.12×10^9 vs ADOF: 1.74×10^9 (57.8% reduction)
• Inference time: LGrad = 4.81ms vs ADOF = 0.40ms per image on RTX A4000

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2606.25297.

Fig 1: Comparison of different synthetic image detection methods on the Ojha

Fig 2: The left image represents the original image, the middle shows the gradient

Fig 3: Architecture of our lightweight model.

Fig 4: Standard pipeline for Image Synthesis Methods

Limitations

• The training set uses only 4 classes from ForenSynths, which may limit coverage of object diversity and synthetic model variance.
• Evaluation lacks adversarial robustness testing against adaptive attackers who might circumvent gradient-based filters.
• No explicit testing under significant distribution shifts beyond benchmark datasets, so generalization to unseen domains or novel generative models is not fully validated.
• The approach focuses on grayscale intensity gradients; subtle attacks exploiting color modalities or blending may escape detection.
• Training epoch count and other hyperparameters are not fully detailed; some reproducibility aspects depend on publicly available but separate baseline codebases.
• Exclusion of gradient orientations near ±π/2 relies on a heuristic that could discard some useful edge-related artifacts in certain cases.

Open questions / follow-ons

• Can the ADOF approach be adapted or extended to include color channel information or multi-scale gradient extraction for improved robustness?
• How does the method perform under adversarial attacks designed to evade gradient-based feature detection?
• Will training with a broader and more diverse dataset containing newer generative models maintain or improve the current generalization levels?
• Could combining the minimalist gradient preprocessing with transformer-based detectors boost performance without large computational costs?

Why it matters for bot defense

This work provides a compelling approach for bot-defense engineers focused on image synthesis or deepfake detection within bandwidth and computationally constrained environments, such as mobile or embedded devices integrated into user authentication flows. The minimalist preprocessing considerably reduces inference latency and energy consumption, enabling near real-time detection of synthesized images that could be used in CAPTCHA or anti-fraud systems. Additionally, the strong demonstrated generalization without extensive data augmentation or ensemble approaches simplifies deployment and maintenance. The filtering strategy specifically reduces noise from irrelevant semantic color information, focusing detection on fine-grained structural artifacts useful for distinguishing AI-generated visual content. However, engineers should carefully consider the limitations regarding adaptive adversaries, dataset diversity, and unseen domain shifts. Overall, the method represents a promising lightweight detection component that could be integrated into multi-factor CAPTCHA pipelines or image-based bot challenges to increase resilience against generative model-based manipulations without overburdening low-resource client devices.

Cite

@article{arxiv2606_25297,
  title={ Minimalist Preprocessing Approach for Image Synthesis Detection },
  author={ Hoai-Danh Vo and Trung-Nghia Le },
  journal={arXiv preprint arXiv:2606.25297},
  year={ 2026 },
  url={https://arxiv.org/abs/2606.25297}
}

Read the full paper

• arXiv:2606.25297 (abstract)
• arXiv:2606.25297 (PDF)