MiraGe: Robust AI-Generated Image Detection

• MiraGe is a method that uses multimodal discriminative representation learning with semantic text anchors to detect AI-generated images.
• The approach minimizes intra-class variations and maximizes inter-class separations to maintain robust performance across diverse and unseen generators.
• Empirical results demonstrate high accuracy and mAP across benchmarks while preserving the pre-trained CLIP backbone with minimal extra parameters.

MiraGe is a method for generalizable AI-generated image detection that targets a specific failure mode of existing detectors: strong performance on known generators combined with substantial degradation on unseen or newly released generators. It is formulated as Multimodal Discriminative Representation Learning for Generalizable AI-Generated Image Detection, and is built around the premise that robust detection requires features that are tightly clustered within each class and well separated across classes. To realize this, MiraGe embeds images together with semantic labels such as “Real” and “Fake” in a shared CLIP feature space, augments CLIP with a multimodal discriminative objective, and uses multimodal prompt learning to preserve the pre-trained backbone while improving cross-generator generalization (Shi et al., 3 Aug 2025).

1. Problem formulation and design objective

The central problem addressed by MiraGe is the limited transferability of AI-generated image detectors across generators. The paper characterizes the weakness of prior methods as a feature-space issue: embeddings from real and generated images can overlap in ways that impair classification when the test distribution contains outputs from unseen generators. MiraGe therefore defines the target of learning not merely as binary classification accuracy on the training set, but as the acquisition of generator-invariant features that remain discriminative under generator shift (Shi et al., 3 Aug 2025).

The method is motivated by two principles stated explicitly in the paper. The first is intra-class variation minimization: features associated with the same semantic class, regardless of generator identity, should lie close together. The second is inter-class separation maximization: features from the real and fake classes should remain well separated. The paper frames these principles as the basis for improved worst-case generalization to unseen generators. This suggests that MiraGe is less a detector-specific heuristic than a representation-learning strategy tailored to cross-distribution robustness.

A further design choice is to use CLIP as the representational substrate. In MiraGe, the real and fake labels are not treated as ordinary classifier targets alone; they are also instantiated as semantic anchors through text prompts such as “a photo of a Fake” and “a photo of a Real.” This allows the model to align image embeddings with text-defined class prototypes rather than learning a purely image-only discrimination rule (Shi et al., 3 Aug 2025).

2. Theoretical principles

The theoretical account in MiraGe defines two quantities that structure the method. Let $P_X$ denote the distribution of generated images and $Q_X$ the distribution of real images, with $\mathbf{f}^{\rm img}(\cdot)$ and $\mathbf{f}^{\rm text}(\cdot)$ denoting CLIP’s image and text encoders. The text anchors are defined as

$$\mathbf{e}_{\rm Fake} = \mathbf{f}^{\rm text}(\text{“a photo of a Fake”}), \qquad \mathbf{e}_{\rm Real} = \mathbf{f}^{\rm text}(\text{“a photo of a Real”}).$$

The paper then defines the CLIP-based intra-class variation as

$$\mathcal{V}_{\rm CLIP}\bigl(\mathbf{f}^{\rm img},\,\mathbf{f}^{\rm text};\,P_X,\,Q_X\bigr) = \max\Bigl\{ \rho\bigl(P_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Fake}}\bigr), \rho\bigl(Q_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Real}}\bigr) \Bigr\},$$

where $\rho(\cdot,\cdot)$ is a distance and $\delta_{\mathbf{e}}$ is a Dirac measure at $\mathbf{e}$. Lower values of $\mathcal{V}_{\rm CLIP}$ correspond to tighter within-class clustering around the appropriate text anchor (Shi et al., 3 Aug 2025).

The second quantity is inter-class separation: $Q_X$0 Here, $Q_X$1 is the family of fake-image generators and $Q_X$2 is the family of real-image distributions. Higher values of $Q_X$3 indicate stronger separation between classes across source distributions (Shi et al., 3 Aug 2025).

The paper connects these quantities to a generalization bound attributed to Ye et al., stating that reducing $Q_X$4 and maintaining positive $Q_X$5 leads to smaller worst-case error on unseen generators. In operational terms, MiraGe attempts to realize that bound by constructing a shared multimodal space in which same-class examples, including text prototypes, are pulled together while different-class examples are pushed apart.

3. Discriminative representation learning

MiraGe implements its theoretical principles through a supervised contrastive formulation defined over both image embeddings and text anchors. For a batch containing $Q_X$6 images and two text anchors, the pooled embedding set is

$Q_X$7

With index set $Q_X$8, auxiliary sets

$Q_X$9

and class labels $\mathbf{f}^{\rm img}(\cdot)$0, the paper defines the multimodal discriminative loss as

$\mathbf{f}^{\rm img}(\cdot)$1

This objective pulls all Real embeddings toward $\mathbf{f}^{\rm img}(\cdot)$2 and all Fake embeddings toward $\mathbf{f}^{\rm img}(\cdot)$3, while penalizing similarity across classes (Shi et al., 3 Aug 2025).

MiraGe does not replace CLIP’s classification objective. Instead, it retains the standard CLIP cross-entropy formulation: $\mathbf{f}^{\rm img}(\cdot)$4 with

$\mathbf{f}^{\rm img}(\cdot)$5

The full optimization target is

$\mathbf{f}^{\rm img}(\cdot)$6

The role of $\mathbf{f}^{\rm img}(\cdot)$7 is therefore complementary rather than substitutive: it reshapes the geometry of the representation space, while $\mathbf{f}^{\rm img}(\cdot)$8 preserves direct class supervision. A plausible implication is that MiraGe treats robustness as an embedding-organization problem prior to treating it as a decision-boundary problem.

4. Multimodal prompt learning and architecture

A notable feature of MiraGe is that it does not fine-tune all of CLIP. The method freezes the pre-trained image and text encoders and trains only a small set of prompt parameters and adapters, which the paper states adds fewer than $\mathbf{f}^{\rm img}(\cdot)$9 extra parameters (Shi et al., 3 Aug 2025). This design preserves the pre-trained CLIP representation while turning prompt tokens into trainable control points for discriminative alignment.

In the text branch, the original prompt embeddings corresponding to “a photo of a Real” or “a Fake” are retained, and $\mathbf{f}^{\rm text}(\cdot)$0 learnable vectors $\mathbf{f}^{\rm text}(\cdot)$1 are prepended at the input of each transformer layer: $\mathbf{f}^{\rm text}(\cdot)$2 After $\mathbf{f}^{\rm text}(\cdot)$3 layers, the final token is projected to obtain the text embedding $\mathbf{f}^{\rm text}(\cdot)$4 (Shi et al., 3 Aug 2025).

In the vision branch, each text-prompt token is mapped into a vision prompt through a linear adapter $\mathbf{f}^{\rm text}(\cdot)$5: $\mathbf{f}^{\rm text}(\cdot)$6 These learned vision prompts are concatenated with the class token and patch embeddings at each layer: $\mathbf{f}^{\rm text}(\cdot)$7 The final class token $\mathbf{f}^{\rm text}(\cdot)$8 is then projected to yield the image embedding $\mathbf{f}^{\rm text}(\cdot)$9 (Shi et al., 3 Aug 2025).

The backbone is a pre-trained CLIP with a ViT-L/14 image encoder and a matching transformer text encoder. MiraGe additionally uses a FIFO memory bank of size $$\mathbf{e}_{\rm Fake} = \mathbf{f}^{\rm text}(\text{“a photo of a Fake”}), \qquad \mathbf{e}_{\rm Real} = \mathbf{f}^{\rm text}(\text{“a photo of a Real”}).$$0 to store historical embeddings for richer positive and negative sampling in the discriminative loss. Optimization is performed with SGD, learning rate $$\mathbf{e}_{\rm Fake} = \mathbf{f}^{\rm text}(\text{“a photo of a Fake”}), \qquad \mathbf{e}_{\rm Real} = \mathbf{f}^{\rm text}(\text{“a photo of a Real”}).$$1, momentum $$\mathbf{e}_{\rm Fake} = \mathbf{f}^{\rm text}(\text{“a photo of a Fake”}), \qquad \mathbf{e}_{\rm Real} = \mathbf{f}^{\rm text}(\text{“a photo of a Real”}).$$2, batch size $$\mathbf{e}_{\rm Fake} = \mathbf{f}^{\rm text}(\text{“a photo of a Fake”}), \qquad \mathbf{e}_{\rm Real} = \mathbf{f}^{\rm text}(\text{“a photo of a Real”}).$$3, and cosine annealing over 10 epochs on a single NVIDIA L40 GPU (Shi et al., 3 Aug 2025).

5. Experimental setting and empirical results

MiraGe is evaluated on three settings described in the paper. On GenImage, the model is trained on Stable Diffusion v1.4 with $$\mathbf{e}_{\rm Fake} = \mathbf{f}^{\rm text}(\text{“a photo of a Fake”}), \qquad \mathbf{e}_{\rm Real} = \mathbf{f}^{\rm text}(\text{“a photo of a Real”}).$$4 real and $$\mathbf{e}_{\rm Fake} = \mathbf{f}^{\rm text}(\text{“a photo of a Fake”}), \qquad \mathbf{e}_{\rm Real} = \mathbf{f}^{\rm text}(\text{“a photo of a Real”}).$$5 fake images and tested on eight unseen generators including SD v1.5, GLIDE, ADM, VQDM, Wukong, BigGAN, and Midjourney. On UniversalFakeDetect, it is trained on ProGAN with $$\mathbf{e}_{\rm Fake} = \mathbf{f}^{\rm text}(\text{“a photo of a Fake”}), \qquad \mathbf{e}_{\rm Real} = \mathbf{f}^{\rm text}(\text{“a photo of a Real”}).$$6 real and $$\mathbf{e}_{\rm Fake} = \mathbf{f}^{\rm text}(\text{“a photo of a Fake”}), \qquad \mathbf{e}_{\rm Real} = \mathbf{f}^{\rm text}(\text{“a photo of a Real”}).$$7 fake images and tested on six GANs, three diffusion models, and one autoregressive model. In a cross-dataset setting, it is trained on SD v1.4/MSCOCO real versus SD v1.4 fake and tested zero-shot on Sora, DALL-E 3, and Infinity, each with $$\mathbf{e}_{\rm Fake} = \mathbf{f}^{\rm text}(\text{“a photo of a Fake”}), \qquad \mathbf{e}_{\rm Real} = \mathbf{f}^{\rm text}(\text{“a photo of a Real”}).$$8 real and $$\mathbf{e}_{\rm Fake} = \mathbf{f}^{\rm text}(\text{“a photo of a Fake”}), \qquad \mathbf{e}_{\rm Real} = \mathbf{f}^{\rm text}(\text{“a photo of a Real”}).$$9 fake images (Shi et al., 3 Aug 2025).

The reported results are strong across all three settings. On GenImage, MiraGe reaches 92.6 accuracy, compared with baseline values listed in the paper such as CNNDet $$\mathcal{V}_{\rm CLIP}\bigl(\mathbf{f}^{\rm img},\,\mathbf{f}^{\rm text};\,P_X,\,Q_X\bigr) = \max\Bigl\{ \rho\bigl(P_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Fake}}\bigr), \rho\bigl(Q_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Real}}\bigr) \Bigr\},$$0, UnivFD $$\mathcal{V}_{\rm CLIP}\bigl(\mathbf{f}^{\rm img},\,\mathbf{f}^{\rm text};\,P_X,\,Q_X\bigr) = \max\Bigl\{ \rho\bigl(P_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Fake}}\bigr), \rho\bigl(Q_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Real}}\bigr) \Bigr\},$$1, CLIPping $$\mathcal{V}_{\rm CLIP}\bigl(\mathbf{f}^{\rm img},\,\mathbf{f}^{\rm text};\,P_X,\,Q_X\bigr) = \max\Bigl\{ \rho\bigl(P_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Fake}}\bigr), \rho\bigl(Q_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Real}}\bigr) \Bigr\},$$2, and DRCT $$\mathcal{V}_{\rm CLIP}\bigl(\mathbf{f}^{\rm img},\,\mathbf{f}^{\rm text};\,P_X,\,Q_X\bigr) = \max\Bigl\{ \rho\bigl(P_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Fake}}\bigr), \rho\bigl(Q_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Real}}\bigr) \Bigr\},$$3. The per-generator values reported for MiraGe include 96.5 on BigGAN, 91.3 on GLIDE, and 83.2 on Midjourney (Shi et al., 3 Aug 2025).

On UniversalFakeDetect, the paper reports that the best prior result from CLIPping is mAP 95.9 and Acc 86.9, whereas MiraGe reaches mAP 98.3 and Acc 92.9. In the cross-dataset evaluation, MiraGe achieves Acc 95.7 / 96.7 / 97.5 and mAP 99.1 / 99.6 / 99.6 on Sora, DALL-E 3, and Infinity, outperforming the CLIPping values of Acc 94.6 / 92.6 / 90.6 and mAP 98.7 / 98.0 / 97.0 (Shi et al., 3 Aug 2025).

The paper also reports a zero-shot evaluation on FLUX.1-dev and SD 3.5 under a Unified MSCOCO protocol, where MiraGe attains Acc 93.9 / 93.5 and mAP 99.1 / 98.4, with averages of 93.7 and 98.7 respectively. These results are presented as evidence that the method remains robust not only across known benchmark shifts but also against newly emerging systems (Shi et al., 3 Aug 2025).

6. Ablations, interpretation, and research significance

The ablation studies in the paper isolate the contribution of each major component. Removing multimodal prompt learning reduces GenImage accuracy from 92.6% to 85.4%. Adding the discriminative loss without the memory bank raises accuracy to 91.9%, while the full MiraGe configuration with memory bank $$\mathcal{V}_{\rm CLIP}\bigl(\mathbf{f}^{\rm img},\,\mathbf{f}^{\rm text};\,P_X,\,Q_X\bigr) = \max\Bigl\{ \rho\bigl(P_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Fake}}\bigr), \rho\bigl(Q_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Real}}\bigr) \Bigr\},$$4 yields 92.6%. The balance parameter in $$\mathcal{V}_{\rm CLIP}\bigl(\mathbf{f}^{\rm img},\,\mathbf{f}^{\rm text};\,P_X,\,Q_X\bigr) = \max\Bigl\{ \rho\bigl(P_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Fake}}\bigr), \rho\bigl(Q_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Real}}\bigr) \Bigr\},$$5 is reported to be stable for $$\mathcal{V}_{\rm CLIP}\bigl(\mathbf{f}^{\rm img},\,\mathbf{f}^{\rm text};\,P_X,\,Q_X\bigr) = \max\Bigl\{ \rho\bigl(P_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Fake}}\bigr), \rho\bigl(Q_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Real}}\bigr) \Bigr\},$$6, with an optimum at $$\mathcal{V}_{\rm CLIP}\bigl(\mathbf{f}^{\rm img},\,\mathbf{f}^{\rm text};\,P_X,\,Q_X\bigr) = \max\Bigl\{ \rho\bigl(P_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Fake}}\bigr), \rho\bigl(Q_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Real}}\bigr) \Bigr\},$$7 (Shi et al., 3 Aug 2025).

The paper further notes that MiraGe remains sample-efficient. Even with 20k images, it achieves mAP 98.34 and Acc 92.87. For the prompt-to-vision mapping functions, a single linear adapter $$\mathcal{V}_{\rm CLIP}\bigl(\mathbf{f}^{\rm img},\,\mathbf{f}^{\rm text};\,P_X,\,Q_X\bigr) = \max\Bigl\{ \rho\bigl(P_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Fake}}\bigr), \rho\bigl(Q_{\mathbf{f}^{\rm img}(X)},\,\delta_{\mathbf{e}_{\rm Real}}\bigr) \Bigr\},$$8 provides the best trade-off between generalization and computational cost, with a reported Chameleon 69.1% acc (Shi et al., 3 Aug 2025).

Several broader conclusions follow directly from the study. First, MiraGe recasts AI-generated image detection as a multimodal representation-learning problem rather than a purely discriminative classifier design. Second, it uses text embeddings as semantic anchors in a way that constrains class geometry across generators. Third, the results indicate that generalization to unseen generators can be improved without full end-to-end fine-tuning of CLIP, by training only prompt vectors, small adapters, and a lightweight classification head (Shi et al., 3 Aug 2025).

A common misconception in this area is that robustness to new generators is primarily a matter of exposing the detector to more generator families during training. MiraGe instead suggests that the geometry of the learned feature space is a principal bottleneck. Another possible misconception is that prompt learning is merely a parameter-efficient substitute for conventional fine-tuning; in MiraGe, prompt learning is structurally tied to the discriminative objective and to the use of “Real” and “Fake” as semantic anchors, rather than serving only as a low-cost optimization device.

In this sense, MiraGe occupies a specific place in the literature on synthetic-image detection: it proposes an explicitly multimodal and geometry-aware path to generator-agnostic detection, and its empirical performance across GenImage, UniversalFakeDetect, Sora, DALL-E 3, Infinity, FLUX.1-dev, and SD 3.5 is presented as evidence that this strategy can improve robustness under rapid generator turnover (Shi et al., 3 Aug 2025).