On the Detection of Synthetic Images Generated by Diffusion Models

Riccardo Corvi; Davide Cozzolino; Giada Zingarini; Giovanni Poggi; Koki Nagano; Luisa Verdoliva

In brief

This paper investigates whether state-of-the-art detectors designed for GAN-generated images can detect synthetic images from diffusion models (DALL·E 2, Stable Diffusion, GLIDE, etc.). Via forensic trace analysis and cross-architecture evaluation, the authors find that some diffusion models leave detectable fingerprints similar to GANs, while others (ADM, DALL·E 2) leave much weaker traces. Critical finding: detectors trained on one model type generalize poorly to others, especially under real-world compression and resizing.

Summary figure for On the Detection of Synthetic Images Generated by Diffusion Models

Contributions

Forensic fingerprint analysis: Extracts and visualizes frequency-domain fingerprints from 1000-image residuals for 12+ generative architectures (ProGAN, StyleGAN2, DALL·E Mini, Stable Diffusion, ADM, etc.). Shows that diffusion models exhibit varying levels of detectable artifacts, with GLIDE, Latent Diffusion, and Stable Diffusion showing clear spectral peaks (similar to GANs) but ADM and DALL·E 2 showing much weaker signatures.
Cross-architecture generalization study: Trains detectors (Spec, PatchForensics, Wang2020, Grag2021) on one model family and tests on all others, in both uncompressed and realistically compressed/resized scenarios. Demonstrates severe generalization failure: models trained on ProGAN achieve ~83% accuracy on ProGAN (uncompressed) but only ~50% on other architectures after JPEG compression and resizing.
Robustness analysis under real-world perturbations: Simulates social-media laundering by applying random crops, resizing to 200×200, and JPEG compression (quality 65–100). Shows that AUC remains reasonable but accuracy collapses across the board, revealing the fragility of current methods.
Fusion and calibration experiments: Combines detectors trained on multiple model families (ProGAN + Latent Diffusion) and applies Platt scaling for threshold calibration. Achieves better generalization but still fails on out-of-distribution architectures.

Method

Fingerprint extraction: Following prior work, the method extracts noise residuals Ri = Xi − f(Xi) by applying a denoising filter to remove scene content. The residuals are averaged over 1000 images and Fourier-transformed to analyze spectral structure—distinctive peaks indicate quasi-periodic GAN fingerprints.

Detection approaches tested:

Spec: Frequency-domain classifier using spectral peaks.
PatchForensics: Local patch-based analysis (18 × 18 patches).
Wang2020: ResNet50 with blurring and JPEG compression augmentation.
Grag2021: ResNet50 without early downsampling (preserves high-frequency traces), with intensive augmentation.

Evaluation setup:

Real images: COCO, ImageNet, UCID.
Synthetic: 1000 images per model, 5000 real images.
Training: single-model (e.g., ProGAN only) to test generalization; later, multi-model fusion (ProGAN + Latent Diffusion).
Metrics: AUC and accuracy (at fixed threshold 0.5), plus resized/compressed variants.

Results

Uncompressed synthetic images (PNG):

Detectors achieve near-perfect AUC on the training model (ProGAN: 99.2% AUC) but degrade on unseen architectures.
Grag2021 remains reasonably robust (94–100% AUC on most models) but accuracy is often random because the decision threshold doesn't transfer across model families.

Compressed and resized images (realistic social-media scenario):

AUC drops significantly: average 52.7% across all models (near random).
Accuracy is extremely low (~50%) for most combinations, indicating threshold collapse.
Diffusion model pairs with shared artifacts (Stable Diffusion & Latent Diffusion, trained on ADM) show cross-detection: when trained on Latent Diffusion, achieves 97.1% AUC and near 100% AUC on Stable Diffusion but only 52.9% on ADM.

Fusion + calibration:

Fusing Grag2021 trained on both ProGAN and Latent Diffusion, then applying Platt scaling, improves accuracy substantially (average 87.8% AUC).
Still fails on DALL·E 2 and ADM when unseen during training (50–70% AUC post-calibration).

Key observation: Architecture-specific forensic cues are very brittle. Stable Diffusion and Latent Diffusion share similar artifacts and cross-detect well; Latent Diffusion and ADM do not, despite both being diffusion models.

Notes

Strengths:

Systematic, large-scale comparison across 12 generative architectures (the first comprehensive diffusion-model detection study at the time of publication).
Realistic evaluation: social-media compression and resizing are often overlooked in prior synthetic-image work but are critical for real-world deployment.
Thorough forensic analysis (fingerprint visualization, spectral decomposition) provides interpretability.
Code and datasets are publicly released.

Weaknesses:

Limited to image-level detection; no discussion of patch-level or video-level synthesis.
Generalization remains unsolved: no principled detector emerges. The paper documents the problem but doesn't propose a solution beyond fusion + calibration (which still fails on unseen models).
DALL·E 2 results remain preliminary (very weak artifacts); more analysis of why CLIP-based models leave fewer traces would be valuable.
No adversarial robustness evaluation (e.g., can perturbations fool the detectors?).

Follow-ups:

Later work 2023-ojha-universal-fake-image-detectors addressed cross-architecture generalization by using frozen CLIP-ViT features, achieving much better out-of-distribution performance.
Research on diffusion-model defenses (e.g., adding imperceptible noise during generation) to evade detection.

How it connects

Builds on CNN-generated images are surprisingly easy to spot... for nowWang et al. · arXiv · 2019 Contrasts with Towards Universal Fake Image Detectors that Generalize Across Generative ModelsOjha et al. · arXiv · 2023