ML Security PapersTraining-free Detection of AI-generated images via Cropping Robustness
Sungik Choi 1,2, Hankook Lee 3, Moontae Lee 1,2
Published on arXiv
2511.14030
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
WaRPAD achieves competitive detection performance across images from 23 generative models without any task-specific training, while remaining robust to common test-time corruptions
WaRPAD
Novel technique introduced
AI-generated image detection has become crucial with the rapid advancement of vision-generative models. Instead of training detectors tailored to specific datasets, we study a training-free approach leveraging self-supervised models without requiring prior data knowledge. These models, pre-trained with augmentations like RandomResizedCrop, learn to produce consistent representations across varying resolutions. Motivated by this, we propose WaRPAD, a training-free AI-generated image detection algorithm based on self-supervised models. Since neighborhood pixel differences in images are highly sensitive to resizing operations, WaRPAD first defines a base score function that quantifies the sensitivity of image embeddings to perturbations along high-frequency directions extracted via Haar wavelet decomposition. To simulate robustness against cropping augmentation, we rescale each image to a multiple of the models input size, divide it into smaller patches, and compute the base score for each patch. The final detection score is then obtained by averaging the scores across all patches. We validate WaRPAD on real datasets of diverse resolutions and domains, and images generated by 23 different generative models. Our method consistently achieves competitive performance and demonstrates strong robustness to test-time corruptions. Furthermore, as invariance to RandomResizedCrop is a common training scheme across self-supervised models, we show that WaRPAD is applicable across self-supervised models.
Key Contributions
- WaRPAD: a training-free AI-generated image detector that exploits the sensitivity of image embeddings to high-frequency perturbations via Haar wavelet decomposition
- Patch-based scoring scheme that simulates cropping robustness by dividing rescaled images into patches and averaging per-patch scores
- Demonstrated generalization across 23 generative models, diverse resolutions/domains, and multiple self-supervised backbone models with strong robustness to test-time corruptions
🛡️ Threat Analysis
Proposes a novel detection method for AI-generated images — directly addresses output integrity and content authenticity by distinguishing synthetic from real images across 23 generative models without task-specific training.