NTIRE 2026 Challenge on Robust AI-Generated Image Detection in the Wild

Abstract: This paper presents an overview of the NTIRE 2026 Challenge on Robust AI-Generated Image Detection in the Wild, held in conjunction with the NTIRE workshop at CVPR 2026. The goal of this challenge was to develop detection models capable of distinguishing real images from generated ones in realistic scenarios: the images are often transformed (cropped, resized, compressed, blurred) for practical usage, and therefore, the detection models should be robust to such transformations. The challenge is based on a novel dataset consisting of 108,750 real and 185,750 AI-generated images from 42 generators comprising a large variety of open-source and closed-source models of various architectures, augmented with 36 image transformations. Methods were evaluated using ROC AUC on the full test set, including both transformed and untransformed images. A total of 511 participants registered, with 20 teams submitting valid final solutions. This report provides a comprehensive overview of the challenge, describes the proposed solutions, and can be used as a valuable reference for researchers and practitioners in increasing the robustness of the detection models to real-world transformations.

• The paper introduces a large-scale dataset comprising over 294,000 images with 36 distinct distortions to simulate real-world conditions.
• The paper leverages transformer-based ensembles and hierarchical augmentation strategies to achieve robust detection, attaining ROC AUC scores up to 0.997 on clean data.
• The paper demonstrates that model capacity, data heterogeneity, and aggressive augmentation are key to generalizing detection methods against adversarial image manipulations.

NTIRE 2026 Challenge on Robust AI-Generated Image Detection in the Wild: An Expert Summary

Challenge Motivation and Dataset Construction

The NTIRE 2026 Challenge on Robust AI-Generated Image Detection in the Wild addresses critical open questions in AI-generated image forensics under unconstrained, post-processed, and heavily degraded conditions. The proliferation of high-fidelity generative architectures—including modern diffusion, GAN, and autoregressive models—has rendered image authenticity assessment a challenging open-set detection problem. Prior benchmarks inadequately model the real-world scenario, where images often undergo arbitrary transformation pipelines (compression, cropping, downsampling, noise, watermarking, or adversarial erasure) before reaching detectors, resulting in dramatic robustness failures when evaluated out-of-distribution.

The challenge introduces a novel large-scale dataset comprising 108,750 real and 185,750 synthetic images from 42 generators spanning recent open-source and API-restricted models from 2022–2026. Critically, the dataset systematically incorporates 36 types of image distortions, with transform type/magnitude randomized and varied across splits, providing a granular measurement of robustness and generalization. Real images are drawn from filtered sections of CC12M, CommonPool, and RedCaps, further curated for semantic relevance and near-duplicate elimination using VLM-based tools, followed by matched prompt generation for synthetic images (using paired LLMs for caption rewriting). All splits preserve domain, content, and distributional matching and enforce strict separation of generator sources between train/val/test splits to rigorously evaluate cross-generator generalization capacity.

Challenge Tracks and Evaluation Protocol

Detection systems were assessed using:

• Robust ROC AUC: Area under the ROC curve, computed on all distorted test images across both public (open) and hidden (private) test sets, serving as the primary ranking metric.
• Clean ROC AUC: Computed on undistorted (“clean”) test images, indicating upper-bound accuracy in controlled settings.

The test splits included a diverse set of unseen (especially proprietary) generative models and aggressive/unseen transformation types, preventing overfitting and incentivizing generalization under hard, realistic detector evasion pipelines.

Methodological Advances in Participating Systems

MICV: DINOv3 Ensemble with Hierarchical Data and Augmentation

The winning solution, MICV, leverages a two-stream, committee-based ensemble architecture centered on DINOv3 visual transformers. A heterogeneous, hierarchical data pool (open-source/public/synthetic/commercial) exposes the model to maximal variability. Domain robustness is enforced through a staged augmentation process—ranging from individual degradations to compounded, multi-operation transformations—mirroring the stochastic distortion process applied in the challenge and reducing reliance on brittle low-level forensic cues. The ensemble fuses outputs from several backbone configurations, with global calibration via Focal Loss and stability from Stochastic Weight Averaging. The solution achieves leading robust and clean ROC AUC metrics.

Figure 1: MICV method: ensemble of DINOv3 backbones, late-fusion, and hierarchical robust augmentation.

Ant International: Model Scaling and Dual-Expert Ensembles

Ant International’s runner-up system underscores the efficacy of scaling both data and backbone size. Training utilizes approximately 1 million images (self-generated and public sets) and an offline, four-level distortion augmentation protocol (from clean to heavy). The dual-expert ensemble consists of two DINOv3-7B (7B parameter) backbones, each fine-tuned with architecture- and task-specific augmentation. One expert specializes in high-resolution, aggressive-augmentation regimes; the other on broad-augmentation/clean split balancing. Test time involves heavy ensembling and TTA, yielding competitive generalization to both public and hidden splits.

Figure 2: Ant International dual-expert DINOv3-7B scheme with multi-level augmentation pipeline.

TeleAI-TeleGuard: LoRA-Based Pairwise Robust Training

TeleAI-TeleGuard introduces LoRA-based Pairwise Training (LPT), applied to the EVA-CLIP backbone. Pairwise batches of clean/distorted images train the model to explicitly align distortion-perturbed representations with clean baselines, using a composite loss (cross-entropy, KL divergence, and MSE in feature space). Their robustness strategy extends the distortion pool beyond the official challenge transforms (e.g., organic moiré, color cast) and raises distortion severity.

Figure 3: TeleAI-TeleGuard LPT pipeline: foundation-model fine-tuning, synthetic distortion, and pairwise feature correction.

INTSIG: Multi-Stage, Heterogeneous Backbone Pipeline

INTSIG presents a multi-stage, five-model system combining backbone diversity (DINOv3-Huge, MetaCLIP2-Giant) and resolution scaling. It incorporates incremental data and augmentation expansion (including OOD datasets), high-resolution feature branches, and backbone swapping with partial fine-tuning. Final predictions result from hierarchical logit fusion, with dual-gating to recognize and correct anomalous ensemble behavior.

Figure 4: INTSIG method: progressive expansion, backbone and resolution diversity, logit fusion.

Additional Approaches: Heterogeneous and Prototype-Guided Ensembles

Reagvis Labs’s RAPID and PSU’s PRISM exemplify ensembling across paradigms—contrastive transformers (CLIP, SigLIP, EVA-02), self-supervised ViTs, and forensic CNNs—arguing that no single feature space adequately spans the full artifact manifold. Fusion heuristics are driven by robust validation, with run-time and calibration trade-offs made explicit. Other teams (e.g., UESTC, Shallow Real) incorporated self-distillation, deep supervision, dynamic resolution, and metric learning components.

Figure 5: RAPID (Reagvis Labs): staged logit fusion across CLIP, SigLIP, SRM/CNN, and masked-image models.

Figure 6: PSU PRISM: paradigm-diverse representation integration across vision-language, self-supervised, and supervised CNNs.

Figure 7: Shallow Real: DINOv3-L backbone, multi-aspect classification, deep supervision, and supervised contrastive loss.

Quantitative Results and Comparative Analysis

Top solutions (MICV, Ant International) achieve robust ROC AUC scores of 0.972–0.973—exceeding 0.99 on clean data and maintaining high discriminability under heavy, compound distortion. Second-tier contenders (e.g., TeleAI-TeleGuard, INTSIG) realize clean ROC AUC near 0.98–0.99 but fall to ~0.91–0.92 under robust conditions, exposing the severity of robustness collapse in non-ensemble or non-scaled systems. A clear separation remains below, with models lacking systematic data or augmentation protocols trailing further, especially for robustness on private generators.

Team	Clean ROC AUC (avg)	Robust ROC AUC (avg)
MICV	0.9974	0.9723
Ant International	0.9972	0.9721
TeleAI-TeleGuard	0.9786	0.9251
INTSIG	0.9897	0.9130
Lower ranked teams	<0.98	<0.88

The small gap between the top two entries suggests a near-optimal exploitation of currently available transformer and augmentation protocols within available computational budgets.

Implications and Outlook

This challenge establishes an actionable reference for evaluating deepfake detection methods under real-world constraints. The findings affirm that:

• Model capacity, data heterogeneity, and aggressive, protocol-matched augmentation are essential for both clean and robustness-aware generalization.
• Transformer-based ensembles (especially at scale) with careful fusion of committee outputs outperform single-backbone or narrow-trained models.
• Performance still degrades significantly under strong distribution shift, unseen generators, and extreme transformations, indicating ample room for improvement particularly in the face of adaptation, adversarial evasion, and forensic artifact minimization trends.

Practically, the most competitive methods are feasible for deployment in real-time settings given the operational efficiency optimizations (e.g., memory-aware sequential or parallel inference, reduced backbone fine-tuning via LoRA/LayerNorm-only adaptations).

Theoretically, the persistence of domain gaps and robust generalization shortcomings motivates further research in artifact-invariant feature learning, foundation model adaptation, and open-set distributionally robust optimization. Future evaluation may increasingly involve simultaneous adversarially crafted transformations, cross-modal and multi-source authenticity signals, and continual adaptation to new generative models as they emerge.

Conclusion

The NTIRE 2026 Challenge meaningfully advances the state of the art in robust AI-generated image detection by bridging data, architecture, and augmentation—offering both a highly challenging benchmark and an annotated survey of effective methodologies. While major progress has been made, robust generalization across open-set transforms and entirely novel generator distributions remains an unsolved problem, underscoring the urgent need for further advances in adaptive, explainable, and foundational visual forensics.

---

Reference: "NTIRE 2026 Challenge on Robust AI-Generated Image Detection in the Wild" (2604.11487)