RA-Det: Towards Universal Detection of AI-Generated Images via Robustness Asymmetry

TL;DR

Results indicate that robustness asymmetry is a stable, general cue for synthetic-image detection and that carefully designed probing can turn this cue into a practical, universal detector.

Abstract

Recent image generators produce photo-realistic content that undermines the reliability of downstream recognition systems. As visual appearance cues become less pronounced, appearance-driven detectors that rely on forensic cues or high-level representations lose stability. This motivates a shift from appearance to behavior, focusing on how images respond to controlled perturbations rather than how they look. In this work, we identify a simple and universal behavioral signal. Natural images preserve stable semantic representations under small, structured perturbations, whereas generated images exhibit markedly larger feature drift. We refer to this phenomenon as robustness asymmetry and provide a theoretical analysis that establishes a lower bound connecting this asymmetry to memorization tendencies in generative models, explaining its prevalence across architectures. Building on this insight, we introduce Robustness Asymmetry Detection (RA-Det), a behavior-driven detection framework that converts robustness asymmetry into a reliable decision signal. Evaluated across 14 diverse generative models and against more than 10 strong detectors, RA-Det achieves superior performance, improving the average performance by 7.81 percent. The method is data- and model-agnostic, requires no generator fingerprints, and transfers across unseen generators. Together, these results indicate that robustness asymmetry is a stable, general cue for synthetic-image detection and that carefully designed probing can turn this cue into a practical, universal detector. The source code is publicly available at Github.

Figures (6)

• Figure 1: Robustness asymmetry between natural and synthetic images in embedding spaces (CLIP radford2021learning, DINO siméoni2025dinov3). Under perturbation, show minimal embedding displacement, while synthetic images exhibit large representation drift (high displacement).
• Figure 2: Backbone-agnostic evidence of robustness asymmetry. We measure embedding stability as the cosine similarity between features extracted from the clean image and its perturbed counterpart. Real images maintain higher similarity than synthetic images, and the separation remains consistent for both DINOv3 and CLIP.
• Figure 3: Overview of RA-Det. The framework processes real and fake images through three key phases to identify generative content: (I) Differential Robustness Probing (DRP) generates targeted perturbations to amplify the robustness asymmetry between real and synthetic images. (II) The Multi-Branch Detector aggregates complementary forensic evidence by analyzing high-level semantic features, quantifying feature-space stability via the discrepancy branch, and capturing pixel-level artifacts through the low-level residual branch. (III) Contrastive Loss guides the training by enforcing a margin between the feature displacements of real and fake images.
• Figure 4: Radar chart comparison of multiple detectors.
• Figure 5: Performance comparison under common image perturbations. The plots show detector performance against (a) JPEG compression (QF = 95, 90 and 85) and (b) Gaussian blur ($\sigma$ = 0.8, 1.0 and 1.5). The mean scores (diamonds) indicate that our method, RA-Det, maintains the highest accuracy and AP, demonstrating superior robustness.

Theorems & Definitions (4)

• Lemma 4.2: Small-radius positive margin
• Theorem 4.3: Lower bound on the shift gap
• proof : Derivation for Lemma \ref{['lem:delta-positive']}
• proof : Derivation for Theorem \ref{['thm:shift-gap']}