Where Detectors Fail: Probing Generative Space for Generalizable AI-Generated Image Detection

Abstract: Detecting AI-generated images (AIGI) remains challenging because detectors often fail to generalize to unseen generators. Although existing methods are trained on large datasets, their performance still degrades when generation settings change, indicating that data scale alone is insufficient and that limited coverage of generative variations during training is a key factor. Studies on generative model editing show that small changes in internal representations can produce diverse and meaningful image variations, many of which are not explored under standard sampling. Leveraging this insight, we propose PROBE (Probing Robustness via Boundary Exploration), a framework that improves detector generalization by actively exploring challenging regions of the generative process. Instead of treating the generator as a fixed data source, PROBE uses the detector as a critic to steer the generator through manifold-level modifications, producing realistic samples that are difficult to classify. These samples expose failure cases that are uncommon under standard data sampling strategies and are used to refine the detector. Experimental results across multiple benchmarks indicate that PROBE enhances generalization to unseen generators, resulting in more generalizable AIGI detection performance. Code and models are available at https://github.com/Amamiya-C/PROBE-AIGI-Detection

• The paper introduces PROBE, a boundary-driven framework that leverages detector feedback to generate hard, boundary-induced samples for improved image detection.
• It employs targeted LoRA-based fine-tuning of generator attention layers and perceptual regularization to maintain photorealism while challenging detectors.
• Empirical results across seven benchmarks show significant accuracy gains and heightened robustness to post-processing, demonstrating cross-generator transferability.

Probing Generative Space for Generalizable AI-Generated Image Detection: An Expert Overview

Motivating the Challenge of Generalization in AI-Generated Image Detection

The proliferation of high-fidelity generative models—particularly diffusion-based architectures—has made the task of detecting AI-generated images increasingly complex. Despite the apparent success of current detectors on seen generators, performance degrades significantly when evaluated against unseen generators or even minor generative variations, indicating substantial limitations with conventional training paradigms. The central problem addressed is not merely dataset scale or model capacity, but insufficient generative space coverage during detector training, which leads to overfitting to artifacts or idiosyncrasies specific to generators used for data synthesis.

PROBE: Boundary-Driven Exploration Framework

PROBE (Probing Robustness via Boundary Exploration) conceptualizes generator-based image creation as a dynamic exploration within a high-dimensional latent generative space rather than a static sampling procedure. Instead of solely augmenting training sets with additional data from various generators, PROBE actively perturbs the generator parameters using the detector itself as a critic. The generator is steered toward producing samples that are visually realistic yet lie near or across the detector’s decision boundary—regions where detector uncertainty peaks. These "boundary-induced" fake samples are inherently hard cases, not encountered in passive sampling strategies, and are instrumental for robust detector learning.

Figure 1: PROBE enhances detector generalization by guiding a generator toward boundary regions via detector feedback and fine-tuning the detector on these challenging samples, thereby reshaping its decision boundary for better robustness.

Implementation Details: Generative Boundary Probing and Detector Refinement

PROBE operates in two stages:

1. Generative Space Probing: LoRA modules are inserted into generator attention layers for targeted fine-tuning while keeping original weights frozen, ensuring that updates are lightweight and controllable. The generator is optimized via a reward function derived from the detector’s outputs, explicitly minimizing the probability of the detector correctly labeling an image as fake.
2. Detector Fine-tuning: The detector is then retrained using a mixture of real images, standard generator samples, and the boundary-induced samples, forcing the feature extractor to learn more discriminative, generator-agnostic representations.

Perceptual regularization (measured using VGG-19-based features, see [hpsv3]) is integral to the PROBE optimization objective. This ensures that generated adversarial samples remain photorealistic and semantically aligned, preventing degenerate or unrealistic outputs common in naive adversarial augmentation.

Figure 2: PROBE's overall pipeline: detector-guided generator probing yields hard samples, which are then used for boundary-aware detector retraining.

Figure 3: Effect of perceptual regularization: balanced realism and semantic alignment via appropriate regularization stabilizes generation, whereas its absence leads to visual artifacts.

Empirical Results: Generalization and Robustness Analysis

Extensive evaluation across seven benchmarks (including both in-house and complex in-the-wild datasets) demonstrates that PROBE substantially boosts the generalization capability of several baseline architectures, including ResNet50 and DINOv2-ViT-L. Notably, average balanced accuracy improvements of 14.6% (ResNet50) and 6.5% (DINOv2) were achieved over baselines. PROBE consistently outperforms state-of-the-art methods, including those leveraging large-scale multi-generator datasets (e.g., CommunityForensics, CoDE) and strong vision-language backbones (e.g., CLIP, UnivFD).

Detector robustness against post-processing (blurring, resizing, compression) also improved markedly under PROBE—balanced accuracy remains above 90% even under strong transformations, far exceeding artifact-focused methods susceptible to distribution shifts.

Figure 4: PROBE-DINOv2 demonstrates pronounced post-processing robustness compared to previous methods under Gaussian blur, compression, and resizing.

Boundary Exploration: Generator-Agnostic and Cross-Architecture Generalization

A critical finding is that boundary-induced samples generated using a single diffusion model reveal detector weaknesses that are transferable to diverse unseen generator families, including GANs and autoregressive models. Feature-space and spectral analyses establish that PROBE samples cluster with those from unseen generators, exposing shared ambiguities rather than artifacts specific to the probing generator. Aggregating boundary-induced samples from several generators or detectors yields incremental gains, further broadening coverage of failure modes.

Figure 5: Boundary-induced samples generated by different critics largely overlap in feature space, uncovering similar hard regions of the generator manifold.

Figure 6: (a) PROBE samples for ResNet50 overlap with distributions from unseen generators (DALL·E 3, Midjourney, FLUX); (b) isolated BigGAN samples highlight limits for generator coverage.

Figure 7: Denoising residual energy spectra show strong similarity between PROBE samples and unseen generators; BigGAN deviates, correlating to persistent detector failures.

Robustness Against High-Quality Generation

The study also reveals that improvements in generator realism can induce substantial distribution shifts that challenge detectors. For example, detectors trained on SD 1.5 fail to generalize to SD 1.5-Realistic-Vision outputs, despite identical prompt settings, emphasizing the necessity for mechanisms such as PROBE that target detector boundary adaptation rather than mere data scale.

Figure 8: Detectors’ accuracy drops on more realistic SD~1.5-Realistic-Vision images, but PROBE maintains strong performance under identical generation parameters.

Figure 9: SD~1.5-Realistic-Vision images (top row) are visually closer to natural images than standard SD~1.5 (bottom row), posing a greater challenge for detectors.

Theoretical and Practical Implications

PROBE introduces a paradigm shift from data-centric augmentation to boundary-driven optimization, highlighting the importance of active exploration of generative space for generalizable detection. By exposing the detector to boundary-induced variations, the reliance on generator-specific cues is reduced, and learning pivots toward more transferable discriminative features. This approach is extensible: probing with multiple generators and critics can further expand coverage, though the incremental benefits are subject to diminishing returns.

On the theoretical front, the work provides evidence that transferability of detector weaknesses (hard regions) is more tightly linked to shared perceptual ambiguities among generators than to artifacts of particular generation algorithms. Practically, PROBE is data-efficient and incurs only modest computational overhead relative to the gains achieved, making it a scalable solution as generative models evolve.

Future Directions

While current exploration relies on a single modifiable generator, expanding PROBE to operate in fully black-box settings—where the generator cannot be steered—remains an open problem. Multi-generator boundary probing and iterative refinement could further increase generalization potential. Additionally, integrating reward signals from vision-LLMs or multimodal critics may offer enhanced semantic coverage.

Conclusion

PROBE redefines AIGI detection as an adversarial boundary exploration problem, showing that robust generalization is achievable by using detectors as critics to probe generators and fine-tune on hard, realistic samples. The framework consistently augments accuracy across benchmarks, architectures, and processing conditions, offering a principled path toward detector robustness as generative models proliferate and evolve (2605.24906).