Do Transformations Reveal the Truth? Generative Residual Learning for Generalized AI-Generated Image Detection

Source: arXiv:2607.08674 · Published 2026-07-09 · By Kutub Uddin, Nusrat Tasnim, Awais Khan, Mohammad Umar Farooq, Khalid Malik

TL;DR

This paper addresses the challenge of detecting AI-generated images (AIGI) across diverse generative models, including GANs and diffusion models. Traditional detection methods often suffer poor generalization to unseen generators because they rely on generator-specific artifact features extracted from individual images independently. The authors propose a novel approach, GenRes, which explicitly models the relational residual features between an original image and its generatively transformed variants. This leverages a secondary generative transformation to reveal statistical discrepancies inherent in synthetic images that persist across model families. GenRes++ extends this by incorporating a learnable cross-attention mechanism to adaptively aggregate information from multiple transformations, enabling the model to focus on the most discriminative cues.

Technically, both frameworks use a frozen PE-Core vision transformer backbone with parameter-efficient LoRA fine-tuning, followed by projection and relational interaction via a neural tensor network (NTN) to capture bilinear cross-feature dependencies of generative residuals. GenRes++ adds a cross-attention aggregation module over transformed embeddings before applying the NTN. Evaluated on the challenging UniversalFakeDetect benchmark with 19 unseen generative models spanning GAN, other, and diffusion families, GenRes++ achieves state-of-the-art detection performance (95.7% mean accuracy and 99.1% mean average precision), outperforming all prior methods, especially on less studied generator families. Ablations confirm the benefit of using multiple complementary transformations and the NTN layer for relational feature fusion.

Key findings

• GenRes++ achieves 95.7% mean accuracy (mACC) and 99.1% mean average precision (mAP) across 19 unseen generative models, outperforming prior leading methods such as C2P-CLIP (93.8% mACC) and FreLens (95.0% mACC).
• Even with a single generative transform (FFDNet denoising), GenRes achieves 92.6% mACC and 97.0% mAP, surpassing baselines that do not model relational residuals.
• Using 5 diverse generative transforms during training (EnlightenGAN, GFPGAN, Real-ESRGAN, FFDNet, CodeFormer) yields the best detection performance, with additional transforms beyond 5 providing diminishing returns.
• Ablation removing any single transform reduces accuracy significantly; for example, removing FFDNet lowers ACC to 92.3%, indicating the transforms provide complementary cues.
• LoRA adapter rank r=6 produces the best balance between adaptation capacity and generalization, with deterioration seen above r=8 due to potential overfitting.
• PE-Core backbone outperforms CLIP ViT-L/14 and DINO ViT-L/14 by 3.0–4.4% ACC and gains ~1.2% mAP, attributed to richer low-level texture representations.
• NTN-based bilinear relational fusion outperforms simpler fusion methods (subtraction, concatenation, linear layers) by up to 3% absolute accuracy and 2% AP (Fig. 5).
• Detection is robust to JPEG compression and Gaussian noise perturbations (93.4% and 92.7% ACC respectively), though more sensitive to Gaussian blur (86.6% ACC).

Threat model

The adversary is an image content generator producing synthetic images using diverse AI generative models, potentially including unknown architectures at inference. They do not have the ability to modify or control the secondary generative transformations applied during detection. The adversary cannot adapt artifacts post-generation to fully mimic the differential residual signatures exploited by the model, and cannot prevent the detector from accessing multiple transformed versions of the input. The detector aims to distinguish real images from AI-generated ones robustly across unseen generator distributions.

Methodology — deep read

1. Threat Model & Assumptions: The adversary produces AI-generated images using a broad array of generative models, potentially unseen during training. The detection system assumes no knowledge of the specific generator architecture or fingerprints at inference. It can apply secondary generative transformations (like restoration, super-resolution) uniformly to both real and synthetic inputs. The adversary cannot circumvent these transforms or manipulate artifacts to evade differential residual signatures.

2. Data: Training data consists of real images and AI-generated images from ProGAN only, covering 4 object categories. Evaluation uses the UniversalFakeDetect benchmark containing 19 unseen generative models across GAN, other, and diffusion families. Each test image undergoes the same set of 5 generative transformations: EnlightenGAN (enhancement), GFPGAN (restoration), Real-ESRGAN (super-resolution), FFDNet (denoising), and CodeFormer (restoration), applied identically to real and fake samples.

3. Architecture / Algorithm: The core pipeline encodes the input image I0 and its N transformed variants {Ii} via a shared frozen PE-Core vision transformer backbone (G14-448) producing 1536-d embeddings. Parameter-efficient task adaptation is done with LoRA on Q/K/V projection matrices (rank r=6, α=8). Encodings are ℓ2-normalized and linearly projected to a compact d=256 space.

GenRes uses a Neural Tensor Network (NTN) to model relational features f between original z0 and a single transformed zi embedding capturing multiplicative cross-feature interactions: f = tanh(z0^T W zi + [z0; zi]^T V + b), with W tensor dimensionality dxdx128. A linear classification head maps f to logits.

GenRes++ extends this by aggregating multiple transformed embeddings via a cross-attention aggregation (CCA) module, using z0 as query and {zi} as keys and values to produce an aggregated vector gagg. NTN is then applied between z0 and gagg before classification.

4. Training Regime: Training uses AdamW optimizer at 4e-4 learning rate with 0.05 weight decay and betas (0.9, 0.999). The learning rate decays multiplicatively by 0.9 every 10 epochs. Only LoRA adapters, projection layers, CCA module, NTN, and classifier head are trained; backbone is frozen. Automatic mixed precision is used for efficiency. Training epochs and batch sizes are not explicitly stated. Data augmentation includes random horizontal flipping.

5. Evaluation Protocol: Metrics are per-class accuracy (ACC) and average precision (AP) across 19 unseen generative models grouped into three families. GenRes and GenRes++ are compared against 12 recent baselines like CNN-Spot, PatchForensics, FreqNet, UniFD, FatFormer, C2P-CLIP, and FreLens. Ablations cover the number of transforms, individual transform removal, LoRA rank tuning, fusion strategy comparisons, backbone selection, and robustness against Gaussian blur, JPEG compression, and noise.

6. Reproducibility: Paper does not mention public code or pretrained weights. It uses publicly available backbones and benchmark datasets (UniversalFakeDetect). Exact seeds or training epochs are unspecified. The described modular design and detailed hyperparameters should assist replication, though transform implementation details could be non-trivial.

Technical innovations

• Introduction of relational generative residual learning between original and transformed images to capture distributional discrepancies that generalize across unseen AI generators.
• Use of a Neural Tensor Network (NTN) for bilinear multiplicative interaction modeling of embeddings rather than simple subtraction or concatenation, better capturing cross-feature correlations characteristic of synthetic residuals.
• Development of GenRes++ incorporating a learnable cross-attention aggregation (CCA) mechanism to weight and fuse relational residual features adaptively from multiple generative transformations.
• Leveraging a frozen PE-Core vision transformer backbone with parameter-efficient LoRA adaptation to obtain semantically rich and generalized embeddings for cross-domain synthetic image detection.

Datasets

• UniversalFakeDetect — spanning 19 unseen generative models across GAN, other, and diffusion families — public benchmark [32].
• Training dataset: ProGAN-generated AI images and corresponding real images (size and split details unspecified) from 4 object categories.

Baselines vs proposed

• PatchForensics: mACC = 71.2% vs GenRes++: 95.7%
• F3Net: mACC = 71.3% vs GenRes++: 95.7%
• FreqNet: mACC = 85.1% vs GenRes++: 95.7%
• CNN-Spot: mACC = 69.6% vs GenRes++: 95.7%
• LGrad: mACC = 80.3% vs GenRes++: 95.7%
• NPR: mACC = 87.6% vs GenRes++: 95.7%
• UniFD: mACC = 81.4% vs GenRes++: 95.7%
• FatFormer: mACC = 90.9% vs GenRes++: 95.7%
• RINE: mACC = 91.3% vs GenRes++: 95.7%
• C2P-CLIP: mACC = 93.8% vs GenRes++: 95.7%
• FreLens: mACC = 95.0% vs GenRes++: 95.7%
• GenRes (single-transform, FFDNet): mACC = 92.6% vs GenRes++ (multi-transform): 95.7%
• Backbones comparison (GenRes++): PE-Core mACC = 95.7%, CLIP ViT-L/14 mACC = 91.3%, DINO ViT-L/14 mACC = 92.7%

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.08674.

Fig 1: Comparison between traditional AIGI detection and the

Fig 2 (page 1).

Fig 2: Overview of the proposed GenRes + + framework. The original image I0 and its generative transformed variants {Ii}N

Fig 3: Qualitative comparison of five generative transforms applied to one real and one fake image (BigGAN). Average PSNR/SSIM

Fig 4: Ablation on LoRA rank r. Bars show ACC (%) and

Fig 6 (page 5).

Fig 7 (page 5).

Fig 8 (page 5).

Limitations

• Training data limited to ProGAN-generated images only; generalization relies on residual modeling but may not capture all future generator artifacts.
• Computational complexity and inference latency are relatively high, especially for GenRes++ (4625.6 ms per sample) due to multi-transform processing and NTN, potentially limiting real-time applications.
• Details on training epochs, batch sizes, and random seeds are omitted, limiting exact reproducibility.
• Assessment focuses on classification accuracy on UniversalFakeDetect; robustness to adversarial attacks on detection or adaptive generator evasion was not evaluated.
• Sensitivity to common image perturbations varies; Gaussian blur significantly degrades performance (down to ~86.6% ACC), indicating vulnerability to smoothing-based postprocessing.
• The method requires applying multiple potentially costly generative transformations at test time, increasing deployment complexity.

Open questions / follow-ons

• How robust is relational generative residual learning against adversarial image manipulations specifically designed to bypass secondary transform analysis?
• Can the framework be extended or adapted to video deepfake detection leveraging temporal generative residuals under transformations?
• What is the impact of alternative or more diverse secondary generative transforms beyond the chosen five on detection robustness and computational cost?
• How does model performance hold across different image resolutions, compression formats, and real-world distribution shifts beyond benchmark datasets?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, this work highlights a promising direction for detecting synthetic images beyond generator-specific fingerprints by exploiting the intrinsic statistical behavior of AI-generated content under secondary generative transformations. Incorporating relational residual analysis could improve robustness against the rapidly diversifying generative model landscape and unseen synthetic image types. However, the approach's multiple-transform requirement and computational cost may limit immediate deployment in latency-sensitive or resource-constrained CAPTCHA systems. Adaptation of lightweight or distilled variants of GenRes++ could be explored to balance performance and efficiency. Additionally, the demonstrated robustness across unseen generator families suggests this method could complement existing artifact-driven or representation-based detectors for more generalized bot detection relying on synthetic media clues.

Cite

@article{arxiv2607_08674,
  title={ Do Transformations Reveal the Truth? Generative Residual Learning for Generalized AI-Generated Image Detection },
  author={ Kutub Uddin and Nusrat Tasnim and Awais Khan and Mohammad Umar Farooq and Khalid Malik },
  journal={arXiv preprint arXiv:2607.08674},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.08674}
}

Read the full paper

• arXiv:2607.08674 (abstract)
• arXiv:2607.08674 (PDF)