What makes fake images detectable? Understanding properties that generalize

By Lucy Chai, David Bau, Ser-Nam Lim, Phillip Isola. 2020

454 citations recorded by the source corpus.

The quality of image generation and manipulation is reaching impressive levels, making it increasingly difficult for a human to distinguish between what is real and what is fake. However, deep networks can still pick up on the subtle artifacts in these doctored images. We seek to understand what properties of fake images make them detectable and identify what generalizes across different model architectures, datasets, and variations in training. We use a patch-based classifier with limited receptive fields to visualize which regions of fake images are more easily detectable. We further show a technique to exaggerate these detectable properties and demonstrate that, even when the image generator is adversarially finetuned against a fake image classifier, it is still imperfect and leaves detectable artifacts in certain image patches. Code is available at this https URL.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

On Buggy Resizing Libraries and Surprising Subtleties in FID Calculation (2021, background): “Despite these advances, generative methods continue to be detectable [10, 74], and discriminative networks continue to be sensitive to small perturbations, such as shifts [3, 22] and JPEG compression [29].”
Frequency-Aware Deepfake Detection: Improving Generalizability through Frequency Space Domain Learning (2024, background): “Chai et al. (Chai et al. 2020) adopt limited receptive fields to identify patches that render images detectable, highlighting the importance of specific local features.”
Pros and Cons of GAN Evaluation Measures: New Developments (2021, background): “Similar works have been reported in Chai et al. (2020); Yu et al. (2019).”
Spatial-Phase Shallow Learning: Rethinking Face Forgery Detection in Frequency Domain (2021, methodology): “Moreover, [5] used the patch-based classification to generalize the image forensics.”
The Stable Signature: Rooting Watermarks in Latent Diffusion Models (2023, unknown): “Many works focus on the detection of GAN-generated images [10, 31, 89, 106].”
On Aliased Resizing and Surprising Subtleties in GAN Evaluation (2022, background): “Despite these advances, generative methods continue to be detectable [8, 68], and discriminative networks continue to be sensitive to small perturbations, such as shifts [2, 18] and JPEG compression [25].”
Generative Adversarial Networks (GANs) (2020, background): “Deep learning based software can cause threats to privacy, democracy and national security [215].”
Lips Don't Lie: A Generalisable and Robust Approach to Face Forgery Detection (2020, methodology): “Although current detectors tend to perform well when the training and test distributions are similar, cross-dataset experiments reveal that they underperform on unseen forgeries [35, 8, 38, 43].”
On The Detection of Synthetic Images Generated by Diffusion Models (2022, methodology): “We compare the following detectors: Spec [9], based on frequency analysis, PatchForensics [18], that relies on local patch analysis, Wang2020 [15], a ResNet50 with blurring and compression augmentation, and Grag2021 [16], same backbone as before but avoiding down-sampling in the first layer and inte”
Zero-shot Image-to-Image Translation (2023, background): “However, a line of work has studied whether generated images are detectable, in the context of GANs [65, 36, 12, 59] and more recently, diffusion models [15, 53].”
DIRE for Diffusion-Generated Image Detection (2023, methodology): “We also include diffusion-generated images (ADM [10]) as training data and re-train CNNDetection [47], Patchforensics [4], and F3Net [34], whose training codes are publicly available.”
Towards Universal Fake Image Detectors that Generalize Across Generative Models (2023, methodology): “We follow existing works [10, 25, 34, 49, 52] and report both average precision (AP) and classification accuracy.”
Interpretable and Trustworthy Deepfake Detection via Dynamic Prototypes (2021, background): “Other work examine spatial pyramid pooling module to detect resolution-inconsistent facial artifacts DSP-FWA [35], low-level features and convolutional artifacts [1, 11], or blending artifacts via Face X-ray [33].”
Detection of AI-Generated Synthetic Faces (2022, methodology): “…become M-Gb Resizing (128 × 128) [42] Co-Net No cropping and no resizing [15] FFD Resizing (299 × 299) [54] Wang2020 No cropping and no resizing [8] PatchForensics Resizing (299 × 299) Fig.9.9 ResultsofthemethodsundercomparisonintermsofAUC,Accuracy,Pd@5%andPd@1% for all the tested methods on…”