FakeInversion: Learning to Detect Images from Unseen Text-to-Image Models by Inverting Stable Diffusion

TL;DR

The paper tackles the problem of detecting synthetic images from unseen text-to-image models. It introduces FakeInversion, a diffusion-inversion–based detector that uses the original image $x$ together with a text-conditioned latent noise map $\,\hat{z}_T$ and its reconstructed latent $\hat{z}_0$, decoded as $D(\hat{z}_T)$ and $D(\hat{z}_0)$, as input to a ResNet-50 classifier, with inversion signals obtained via DDIM inversion conditioned on a caption $c$. The method demonstrates strong cross-generator generalization, outperforming prior detectors on both open-source and proprietary models, and a new RIS-based evaluation protocol (SynRIS) is proposed to mitigate theme/style biases and better reflect in-the-wild performance. The paper also provides extensive ablations—including the necessity of the inversion signals and the benefit of text conditioning—and shows robustness to common degradations and transfer to highly stylistically divergent domains. These contributions offer a scalable, bias-aware approach for GenAI safety and establish a publicly available, bias-mpared benchmark for future research.

Abstract

Due to the high potential for abuse of GenAI systems, the task of detecting synthetic images has recently become of great interest to the research community. Unfortunately, existing image-space detectors quickly become obsolete as new high-fidelity text-to-image models are developed at blinding speed. In this work, we propose a new synthetic image detector that uses features obtained by inverting an open-source pre-trained Stable Diffusion model. We show that these inversion features enable our detector to generalize well to unseen generators of high visual fidelity (e.g., DALL-E 3) even when the detector is trained only on lower fidelity fake images generated via Stable Diffusion. This detector achieves new state-of-the-art across multiple training and evaluation setups. Moreover, we introduce a new challenging evaluation protocol that uses reverse image search to mitigate stylistic and thematic biases in the detector evaluation. We show that the resulting evaluation scores align well with detectors' in-the-wild performance, and release these datasets as public benchmarks for future research.

Figures (28)

• Figure 1: (left) We propose a whitenew synthetic image detector that uses two additional input signals derived from a fixed pre-trained Stable Diffusion sd: an inverted latent noise map and the reconstructed input image. (middle) Our detector is trained using fake images generated using Stable Diffusion and real LAION images. It achieves whitestate-of-the-art generalization performance in detecting unseen text-to-image generators. (right) To ensure that the performance evaluation does not favor detectors that are biased towards particular themes or styles, we introduce a whitenew thematically and stylistically aligned evaluation benchmark -- we measure detector's ability to discriminate fake images (e.g. DALL·E 3, Imagen) from real images with matching content and style found on the Internet using reverse image search (RIS).
• Figure 2: Proposed method. In addition to the original image itself ($x$), we also train our detector using the (decoded) noise map $D(\hat{z}_T)$ and reconstruction $D(\hat{z}_0)$ obtained by inverting the image through Stable Diffusion using DDIM. The original image is first mapped to the latent space with Stable Diffusion's VAE Encoder. The latent image is then inverted and reconstructed through Stable Diffusion's U-Net using DDIM while conditioned on the CLIP embedding of the image's predicted BLIP caption. The latent noise map and reconstruction are mapped back to image space using Stable Diffusion's VAE Decoder. The original image, decoded noise map, and decoded reconstruction are then concatenated and used as input for our ResNet Classifier.
• Figure 3: Saliency Analysis. Green boxes highlight the most salient regions according to our model and purple boxes for an equivalent RGB-only model. We use a post-hoc explainability technique, XRAI kapishnikov2019xrai. The regions of anatomical inconsistencies in fakes are most salient in our model.
• Figure A.1: Receiver Operating Characteristic (left) Precision-Recall (middle) and Detection Error Tradeoff (right) curves for detecting Imagen versus real images from its training set WebLI yu2022parti (red), Reverse Image Search (green) and LAION (orange). These curves show that Imagen versus RIS is indeed a significantly harder task than Imagen versus LAION schuhmann2022laion and matches Imagen versus WebLI.
• Figure D.1: Unconditional DDIM inversion and reconstruction catastrophically fails to reconstruct the original image. To remedy this, we predict a caption using BLIP 2 blip and use this for text conditioning.