Beyond Artifacts: Real-Centric Envelope Modeling for Reliable AI-Generated Image Detection¶

Conference: ECCV2026
Paper: ECCV Paper
Code: https://github.com/handsome-rich/REM
Area: AIGC Detection
Keywords: real manifold, envelope modeling, near-real reconstruction, cross-domain consistency, chain degradations

TL;DR¶

Instead of primarily tracking artifacts from known generators, REM learns a feature envelope of real images using controlled reconstructions and stabilizes it across degradations, achieving 84.2% balanced accuracy on RealChain with chain degradations, 18.4 percentage points above DDA.

Background & Motivation¶

The challenge in generated-image detection is not merely that synthetic images look sharper: the statistical cues used during training can disappear as generator architectures change. NPR exploits upsampling traces, SAFE uses frequency inconsistencies, and AIDE combines frequency and semantic signals; these cues may work for fixed generators and clean images without covering future generative models. Real deployment adds another complication: an image can undergo social-platform compression, cross-device transfer, screenshots, cropping, and filters, which can erase low-level artifacts. The detector therefore faces both unseen synthetic sources and input domains in which real and generated images have undergone quality changes.

Expanding the fake training set is a direct response, but the generator set is open-ended, and enumerating current models does not guarantee coverage of the next generation mechanism. The paper instead changes the reference point to real images: the authors regard physical imaging principles and device constraints as relatively stable sources for learning a boundary around the real distribution. This view also draws on data-alignment methods: reconstructing real images reduces semantic differences between real and fake samples, making content-based shortcuts less useful. However, a stable real distribution is a working assumption, not a proven property covering every device, editing pipeline, and future synthesis model.

Plain VAE reconstruction is insufficient because reconstructed samples may concentrate along a limited set of displacement directions and inadequately cover the neighborhood of real data. REM introduces latent perturbations to create more near-real negatives, constrains boundary geometry, and uses cross-domain consistency to counter propagation-induced degradation. It still trains through real/fake binary classification rather than performing entirely negative-free one-class detection; the change concerns how negatives are constructed and what anchors learning. Core Idea: define the detection boundary through real images and their controlled reconstruction neighborhoods, while keeping detection features' offsets from a frozen semantic anchor consistent across quality changes.

Method¶

Overall Architecture¶

Training uses MSCOCO real images as its foundation and produces an image authenticity score, not a generator identity or a manipulation mask. Manifold Boundary Reconstruction (MBR) first creates near-real samples that retain the original content while introducing small statistical deviations. The Envelope Estimator (EE) learns a boundary using binary supervision and tangency regularization, while Cross-Domain Consistency (CDC) constrains feature relationships between clean and degraded views. The detection backbone is DINOv3; CDC uses both a frozen anchor network and a trainable learner to keep detection adaptation from discarding the pretrained structure. The arrows below represent training dependencies: EE and CDC are jointly optimized constraints, not two separate detectors that must run sequentially at inference time.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    Real["Real training images"] --> MBR["Manifold Boundary<br/>Reconstruction (MBR)"]
    MBR -->|Near-real negatives| EE["Envelope Estimator<br/>(EE)"]
    Real -->|Real positives| EE
    EE -->|Joint training constraints| CDC["Cross-Domain<br/>Consistency (CDC)"]
    Views["Clean and degraded views"] --> CDC
    Anchor["Frozen DINO anchor"] --> CDC
    CDC -->|Training produces| Detector["Learner and classification head"]
    Test["Query image"] -->|Inference| Detector
    Detector --> Score["Authenticity score"]

MBR supplies training negatives, and the frozen anchor supplies a training-time feature reference; neither should be mistaken for a procedure that regenerates evidence for every test image. As described in the main text, inference passes a center-cropped image through the learner and classification head to obtain an authenticity prediction. The supplied text does not detail deployment thresholds, calibration, or inference latency, so its scores should not be treated as calibrated probabilities of factual authenticity.

Key Designs¶

1. Manifold Boundary Reconstruction: construct hard negatives around real samples in multiple directions

MBR encodes a real image using a pretrained Stable Diffusion VAE and adds controlled Gaussian noise to randomly selected latent dimensions. A random mask determines which dimensions are perturbed, the noise magnitude controls the displacement, and the VAE decoder maps the perturbed latent back into image space. The clearly legible core transformation from Equation (3) is retained below: \(M\) is the mask, \(\delta\) is Gaussian perturbation, and \(\odot\) denotes elementwise multiplication.

\[ z' = z + M \odot \delta \]

Unlike generating arbitrary scenes from text, reconstruction inherits content from the real image, reducing semantic differences between the two training classes. Unlike unperturbed self-reconstruction, different masks and noise samples create more displacement directions around the same real example, diversifying boundary supervision. These samples are called near-real because they are intended to preserve visual content while departing statistically from the real-image distribution. This is a construction strategy, not proof that every latent perturbation lands on the geometric boundary of the real manifold.

The VAE is a fast training-sample construction tool here and does not require a full diffusion sampling chain for each image. The approach thus seeks to shift data-scaling costs from invoking more large generators toward collecting more real images and reconstructing their neighborhoods. Nevertheless, the reconstructor can introduce decoder-specific bias; a real-image input alone does not establish the complete absence of generator artifacts.

2. Envelope Estimator: separate samples through classification and organize feature geometry through tangency

EE extracts features from real and near-real images and uses binary cross-entropy to assign higher authenticity scores to real samples and place reconstructions on the other side. The envelope is therefore not a separately fitted sphere or density function, but the real-region boundary learned by a classifier in feature space. Classification alone can produce an irregular separating surface around a limited set of reconstructed negatives and still fail on new synthetic sources. The authors additionally take the top \(p\) principal components of real features and construct a projection matrix as an approximation to the real manifold's tangent space. For the paired feature displacement \(\Delta h=h_f-h_r\), the component outside that projection measures departure from this tangent space.

\[ P = U_p U_p^{\top}, \qquad r_{\perp} = (I-P)\Delta h \]

Here \(r_{\perp}\) is notation introduced in this note to explain the orthogonal component, not an additional proposed loss; the paper penalizes this component through tangency regularization. Intuitively, classification demands real/fake separability, while tangency regularization discourages relying entirely on irregular off-manifold displacements. Both act on representation learning, rather than first collapsing every negative onto a real example and subsequently drawing a fixed boundary. A smooth envelope is the authors' geometric interpretation of this training effect, not a formal conclusion established by an error bound or convergence proof in the main text.

The design has an important tension: it must preserve real/fake separability while restricting orthogonal differences between paired features. Consequently, the regularization weight and principal-component dimension affect the resulting separability; stronger regularization is not necessarily better. The supplied text does not specify PCA neighborhood selection, statistical update details, or the value of \(p\), which require implementation-level verification for reproduction.

3. Cross-Domain Consistency: stabilize detection-feature residuals relative to a semantic anchor

CDC constructs clean and degraded views of the same image, using simulated compression and perturbations; the main text refers to the appendix for the training augmentation details. A frozen DINO extracts anchor features for both views, followed by a linear mapping into the learner's feature space. A second DINO adapts to detection through LoRA and produces trainable features for the clean and degraded views. The frozen branch preserves a pretrained reference while the learner acquires detection capability; the two networks do not jointly chase a moving reference.

Anchor consistency keeps learner features close to the mapped frozen features, limiting semantic drift caused by detection fine-tuning. Residual consistency compares learner-minus-anchor features between clean and degraded images. It therefore does not simply force raw features from different quality levels to be identical: it makes the relative change introduced by detection adaptation stable across the two domains. If the frozen features themselves change appropriately under degradation, the residual constraint still permits the learner to retain that shared change.

This explains the difference between CDC and ordinary data augmentation: augmentation supplies more degraded examples, whereas CDC additionally constrains their representation relationships with the originals. The authors interpret this relationship as preserving envelope shape across domains, but the supplied experiments mainly evaluate detection performance and feature visualizations rather than directly measuring deformation of an explicit envelope. The frozen anchor and paired views in the diagram are parts of this design, not independent contribution modules.

A Worked Example¶

Consider an MSCOCO street photograph; this illustrates the workflow rather than introducing a new quantitative case study. Training retains the original photograph as a real positive and applies VAE encoding, random latent perturbation, and decoding to produce a near-real negative. The scene and objects are preserved as far as possible, so the detector must distinguish imaging statistics rather than readily classify images by whether a street scene appears. EE learns the score difference between the two classes while restricting the paired displacement component that does not fit the real tangent structure. Corresponding training images are then represented through clean and degraded views, and CDC compares their feature residuals relative to frozen DINO. At inference time, an unknown image circulated through a social platform only needs to pass through the detector; its original clean version is not required as a paired input. This example also clarifies the supervision boundary: paired training views do not imply knowledge of the platforms or processing chain encountered by a deployed query image.

Loss & Training¶

The total objective combines binary cross-entropy, tangency regularization, anchor consistency, and residual consistency, with three weights controlling the latter terms. Parts of the distribution notation, minus signs, norms, and subscripts in Equations (3)-(8) are corrupted in the cache, particularly the negative-class term in Equation (4); this note explains the mechanisms from the prose without reconstructing purportedly exact author loss formulas. The implementation uses DINOv3 ViT-H+/16 with LoRA and the FT-MSE Stable Diffusion VAE. Larger images are proportionally resized to a short side of 512 as described in the text; training uses random \(224\times224\) crops and inference uses center crops of the same size. Adam uses a learning rate of 0.0001 and batch size of 256; the authors report training for 1 epoch on 4 NVIDIA A100 GPUs in 30 minutes. The data-scale analysis in Figure 7 identifies 100k real samples as the best overall setting, but this does not make all otherwise undisclosed training parameters known. The main text does not supply complete values for noise magnitude, mask ratio, LoRA rank, or loss weights, and the supplied cache does not include the referenced appendix. These details explain the training approach but are not a complete, directly reproducible experimental configuration.

Key Experimental Results¶

Main Results¶

Balanced accuracy, B.Acc, is the arithmetic mean of real-class and fake-class accuracy; table values are percentages, and differences are expressed in percentage points. Table 1 on page 10 uses official method checkpoints and follows DDA's protocol of applying JPEG quality factor 96 to generated images in AIGCDetect, ForenSynths, and GenImage to reduce format bias. The table below excerpts its aggregate columns; RealChain ND means no degradation and CD means chain degradations, and they must be read separately.

Method	Ideal benchmark mean	In-the-wild benchmark mean	RealChain ND	RealChain CD	Paper-reported overall mean
AIDE	53.6	55.8	60.4	50.0	54.7
DRCT	82.2	58.0	69.1	55.4	69.8
Aligned	73.4	74.2	68.7	58.0	72.2
DDA	91.1	88.6	88.8	65.8	88.0
REM	97.6	94.5	92.4	84.2	94.9

REM improves over DDA by 6.5 percentage points on the ideal-benchmark mean and 5.9 percentage points on the in-the-wild mean. The overall 94.9 versus 88.0 is the paper-reported aggregate; without the precise weighting convention, it should not be described as independently recomputed and verified from all visible columns. RealChain CD's 84.2 versus 65.8 corresponds to an 18.4-percentage-point advantage; REM still drops 8.2 percentage points from ND to CD, so degradation is not harmless. Table 1 also does not support winning every dataset: on ForenSynths, REM scores 91.5 while C2P-CLIP scores 92.0.

RealChain's source content contains 7,000 real and 7,000 generated images: 6,000 text-to-image outputs from six models and 1,000 image-to-image outputs from Seedream 4.0. The six text-to-image sources are QwenImage, SDv3.5, Flux.1, Hunyuan 3.0, NanoBanana, and Seedream 4.0. Section 4 constructs 50 processing chains, each containing 1-3 propagation operations and 0-2 post-processing operations, applied to 140 real and 140 generated images per chain. Fifty distinct chains does not mean that every image is processed 50 times consecutively; this distinction matters when interpreting the degradation setting.

Ablation Study¶

The following directly excerpts Table 7 on page 14, again using B.Acc (%); the last column retains the source's aggregate RealChain label rather than incorrectly treating it as CD-only performance. Removing MBR means reverting to plain VAE reconstruction, while removing EE's key constraint means removing tangency loss, not eliminating all classification supervision.

Config	MBR	EE	CDC	Ideal benchmarks	In-the-wild benchmarks	RealChain aggregate
Base configuration	No	No	No	85.5	80.9	76.4
Without CDC	Yes	Yes	No	93.6	85.8	79.4
Without MBR	No	Yes	Yes	91.5	86.3	83.6
Without EE	Yes	No	Yes	93.3	89.5	84.3
Full REM	Yes	Yes	Yes	97.6	94.5	88.3

Key Findings¶

In Table 7, removing CDC reduces in-the-wild performance from 94.5 to 85.8 and the RealChain aggregate from 88.3 to 79.4, supporting the role of cross-degradation consistency.
Removing MBR reduces ideal-benchmark performance from 97.6 to 91.5, showing that fixed reconstruction examples alone do not match the full method's cross-generator results.
The ablation prose separately claims a 16.4% drop without CDC, whereas Table 7's RealChain aggregate difference is 8.9 percentage points; its other claimed drops of 3.6% and 2.3% also cannot be directly recovered from this table, so the conventions are not forcibly reconciled.
Figure 6 additionally tests JPEG, blur, noise, and color distortion on RealChain ND; the curves support REM's relative robustness, but the cached graphics do not permit precise extraction of every point, so no values are invented.

Highlights & Insights¶

Training negatives need not be maximally distant from real images. Content-matched samples with slight statistical shifts can encourage learning a fine boundary instead of using scene differences as shortcuts.
CDC constrains residuals relative to an anchor rather than forcing every quality domain into identical features. This may inform other cross-domain adaptation tasks that must preserve pretrained structure, but transfer benefits need separate experiments.
RealChain combines modern generators with multi-stage propagation. Evaluating unseen generation mechanisms and quality changes together avoids judging deployment reliability only from clean data.
The real-data scaling analysis suggests that, after changing how negatives are constructed, expanding real-domain coverage may deserve priority over enumerating more generators; this is an engineering insight supported by the trend, not a proof of cost optimality.

Limitations & Future Work¶

The authors propose extending the method to video forensics and refining distribution modeling through larger real datasets and more degraded training samples; the paper does not report results for these directions.
From a reader's perspective, real-image distributions still change with cameras, ISPs, screenshots, and strong editing, so the real-centric assumption needs separate validation across broader device and editing domains.
Near-real samples depend on the Stable Diffusion VAE, and the current evidence does not rule out partial reliance on shared traces of that reconstructor.
Balanced accuracy does not establish recall under stringent false-positive constraints, score calibration, or resistance to adaptive attacks; 84.2% alone does not justify unattended authenticity adjudication.
Corrupted formula extraction, the missing appendix, and inconsistent ablation-drop conventions limit exact reproduction; this note preserves the original table values instead of filling gaps with assumed parameters.

Compared with NPR, SAFE, and AIDE: these methods emphasize upsampling, frequency, or combined frequency-semantic evidence, whereas REM organizes training around real-distribution neighborhoods; the difference concerns the learning reference, not merely a replacement classification head.
Compared with UnivFD, FatFormer, and C2P-CLIP: these methods leverage CLIP representations and related adaptation, while REM uses DINO as the detection backbone and frozen anchor with an explicit cross-degradation residual constraint.
Compared with DRCT, Aligned, and DDA: these works show that content and format alignment reduce shortcut learning; REM adds controlled perturbations, tangency constraints, and cross-domain consistency to reconstruction neighborhoods, interpreting alignment benefits through real-boundary learning.
A testable follow-up: hold the DINO backbone and training budget fixed while varying reconstructors, and test whether gains arise from broader real-neighborhood coverage or shared reconstruction traces; this is a reader proposal, not a completed ablation.

Rating¶

Novelty: 4/5. Real-centric training and cross-domain residual constraints form a clear method combination, although the real-manifold envelope interpretation remains largely empirical.
Experimental Thoroughness: 4/5. Broad cross-generator tests, propagation degradations, and module ablations are provided, but clearer ablation conventions and low-false-positive analysis are still needed.
Writing Quality: 3/5. The main argument and module responsibilities are clear, but some reported improvements conflict with table values, and the cache cannot support exact formula recovery.
Value: 4/5. The method is directly relevant to generated-image detection under real propagation, but it does not replace out-of-domain and false-positive validation before deployment.