ML Security PapersCLIP-Flow: A Universal Discriminator for AI-Generated Images Inspired by Anomaly Detection
Zhipeng Yuan 1, Kai Wang 2, Weize Quan 3, Dong-Ming Yan 3, Tieru Wu 1
Published on arXiv
2508.09477
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
CLIP-Flow generalizes effectively to AIIs from diverse unseen generative models (GANs, diffusion models) without requiring any AI-generated images at training time
CLIP-Flow
Novel technique introduced
With the rapid advancement of AI generative models, the visual quality of AI-generated images (AIIs) has become increasingly close to natural images, which inevitably raises security concerns. Most AII detectors often employ the conventional image classification pipeline with natural images and AIIs (generated by a generative model), which can result in limited detection performance for AIIs from unseen generative models. To solve this, we proposed a universal AI-generated image detector from the perspective of anomaly detection. Our discriminator does not need to access any AIIs and learn a generalizable representation with unsupervised learning. Specifically, we use the pre-trained CLIP encoder as the feature extractor and design a normalizing flow-like unsupervised model. Instead of AIIs, proxy images, e.g., obtained by applying a spectral modification operation on natural images, are used for training. Our models are trained by minimizing the likelihood of proxy images, optionally combined with maximizing the likelihood of natural images. Extensive experiments demonstrate the effectiveness of our method on AIIs produced by various image generators.
Key Contributions
- Frames AI-generated image detection as an anomaly detection problem, eliminating the need for AI-generated images during training and improving generalization to unseen generators
- Combines a pre-trained CLIP encoder with a normalizing flow model trained to maximize likelihood of natural images and minimize likelihood of proxy images
- Introduces spectral modification-based proxy image generation as a substitute for AI-generated images in unsupervised training
🛡️ Threat Analysis
Proposes a novel AI-generated image detector — a direct output integrity / content authenticity contribution. The detector generalizes to unseen generative models by framing AII detection as anomaly detection over natural image distributions, using a CLIP encoder and normalizing flow trained only on natural and proxy images.