GLARE: Towards Generalizable Detection of Latent Diffusion Images with Global-Local Reconstruction Error

Conference: ECCV 2026
Paper: ECCV 2026
Area: Image Generation
Keywords: AIGC Detection, Latent Diffusion Models, Training-Free Detection, Reconstruction Error, Context Sensitivity

TL;DR

By contrasting full-image reconstruction against isolated patch-wise reconstruction within a shared pretrained autoencoder and calibrating with shallow edge density, GLARE provides a completely training-free detector that exploits the elevated context dependence of latent diffusion models with state-of-the-art cross-generator generalization.

Background & Motivation

Latent diffusion models (LDMs) have become the preeminent paradigm for high-fidelity text-to-image synthesis by performing iterative denoising in a compact latent space learned by an autoencoder. However, the widespread accessibility and hyper-realistic synthesis capability of LDMs have heightened security and forensic concerns. Conventional detection approaches rely primarily on supervised learning over curated real/fake pairs. While these supervised classifiers attain high in-distribution accuracy, they are prone to severe degradation under domain shifts, novel generative architectures, or unseen sampling recipes, and incur substantial retraining costs whenever new generation frameworks emerge.

Training-free detectors bypass the need for annotated data, offering plug-and-play deployability. Nevertheless, existing training-free techniques face fundamental bottlenecks. Reconstruction-based methods such as AEROBLADE threshold single-path absolute autoencoder reconstruction errors or compression costs; because an image's absolute reconstruction difficulty depends strongly on its intrinsic visual texture complexity, the resulting decision boundaries are inherently fragile across different visual domains. On the other hand, perturbation-based detectors (e.g., measuring feature invariance under Gaussian noise or augmentation consistency with DINOv2) rely on the heuristic assumption that natural images are more robust to external perturbations. They are notoriously sensitive to perturbation hyper-parameters and fail to probe the intrinsic structural artifacts imprinted by the generative synthesis dynamics.

This paper tackles the problem from the generative mechanism itself. During the reverse denoising process in LDMs, cross-attention, self-attention, and global pooling layers repeatedly propagate conditioning semantics across the entire latent feature map over tens of iterations. This multi-step spatial mixing binds distant local regions together, creating an elevated inter-patch context dependence that sharply contrasts with natural images, which predominantly conform to the Markov Random Field (MRF) assumption of localized spatial correlation. Core idea: exploit the rate-distortion information bottleneck of a pretrained autoencoder by contrasting full-image global reconstruction with patch-isolated local reconstruction, using their log-difference to cancel content baselines and expose the heightened context dependence characteristic of LDM-generated images in a training-free manner.

Method

Overall Architecture

GLARE takes an arbitrary test image \(x\) and, without invoking expensive diffusion reverse-sampling steps, processes it through a frozen pretrained LDM variational autoencoder (VAE: encoder \(\mathcal{E}\) and decoder \(\mathcal{D}\)). The pipeline executes two distinct reconstruction paths alongside an adaptive calibration branch. In the global path, the entire image is passed through the VAE to retain complete spatial context, yielding full-image reconstruction error \(e_f(x)\). In the local path, the image is divided into non-overlapping patches, each scaled to the autoencoder's native resolution, independently encoded and decoded in isolation, and stitched back to yield patch-wise error \(e_p(x)\). The logarithmic difference \(\Delta(x)\) quantifies the context sensitivity, which is then normalized by a lightweight Semantic Complexity Calibration Module (SCCM) computing shallow feature edge density \(\Phi(x)\) to produce the final continuous forensic score \(S(x)\).

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["Input Image x"] --> B["Global Full Reconstruction<br/>VAE encodes/decodes with full spatial context"]
    A --> C["Local Patch Reconstruction<br/>Partition into p×p patches, encode/decode independently"]
    A --> D["Semantic Complexity Calibration<br/>Shallow feature Sobel edge density estimation"]
    B --> E["Full-Image Perceptual Error<br/>e_f(x) = LPIPS(x, x_f)"]
    C --> F["Patch-Wise Perceptual Error<br/>e_p(x) = LPIPS(x, x_s)"]
    E --> G["Dual-Path Log-Ratio Scoring<br/>Δ(x) = ln e_f(x) - ln e_p(x)"]
    F --> G
    D --> H["Complexity Bias Normalization<br/>ln Φ(x) = -ln(ρ_edge(x) + ε)"]
    G --> I["Final Decision Score Output<br/>S(x) = Δ(x) + ln Φ(x)"]
    H --> I

Key Designs

1. Global Full-Image Reconstruction and Information Bottleneck Lower Bound

The KL divergence regularization imposed on the LDM autoencoder enforces an information bottleneck that compels the encoder to retain low-frequency, globally coherent semantic structures while dropping micro-details. From classical rate-distortion theory, under a fixed bottleneck capacity, the minimum achievable distortion \(D(x_i \mid x_{\text{ctx}})\) on patch \(x_i\) given available spatial context \(x_{\text{ctx}}\) is a strictly monotonically increasing function \(g\) of the conditional entropy: $\(D(x_i \mid x_{\text{ctx}}) = g\big(H(x_i \mid x_{\text{ctx}})\big), \quad g' > 0\)$ In the full-context path, the entire image \(x\) is supplied to the encoder, providing context \(x_{\text{ctx}} = x_{\neg i}\). For LDM-generated images where cross-patch mutual information \(C_i = I(x_i; x_{\neg i})\) is elevated, the conditional entropy \(H(x_i \mid x_{\neg i}) = H(x_i) - C_i\) is suppressed, allowing the encoder to exploit spatial redundancy and achieve the lower bound of distortion \(e_f(x) = e(x, \mathcal{D}(\mathcal{E}(x)))\).

2. Context-Free Local Reconstruction: Severing Long-Range Dependencies

To reach the opposing extreme of the rate-distortion entropy chain, GLARE partitions \(x\) into \(K\) non-overlapping patches \(\{\Omega_k\}_{k=1}^K\) of size \(p \times p\). Each cropped patch \(x|_{\Omega_k}\) is resized to the autoencoder's native resolution, independently encoded and decoded by \(\mathcal{E}\) and \(\mathcal{D}\), resized back, and reassembled onto the original grid: $\(\hat{x}_p^{(k)} = \mathcal{D}\big(\mathcal{E}(x|_{\Omega_k})\big), \quad \hat{x}_s|_{\Omega_k} = \hat{x}_p^{(k)}, \quad k = 1, \ldots, K\)$ In this isolated path, no surrounding context is accessible (\(x_{\text{ctx}} = \emptyset\)), driving the conditional entropy to its upper bound, the marginal entropy \(H(x_i)\). The resulting stitched reconstruction error \(e_p(x) = e(x, \hat{x}_s)\) establishes the context-free distortion upper bound.

3. Context Sensitivity Log-Ratio Scoring: Cancelling Content Baselines

Single-path reconstruction errors fail as universal discriminators because naturally complex textures induce higher absolute errors regardless of authenticity. GLARE captures the entropy gap via the log-ratio of the two reconstruction paths: $\(\Delta(x) = \log e_f(x) - \log e_p(x) \approx \log \frac{\sum_i g\big(H(x_i \mid x_{\neg i})\big)}{\sum_i g\big(H(x_i)\big)}\)$ Under a Gaussian-quadratic rate-distortion model, \(\Delta(x) \approx -2n\bar{C}\), establishing an inverse linear relationship with average context dependence \(\bar{C}\). Because natural images exhibit weak inter-patch coupling, removing context does not drastically inflate distortion. Conversely, synthetic LDM images rely heavily on global conditioning; severing context causes reconstruction error to spike (\(e_p\) surges). Consequently, \(\Delta(x)\) is systematically smaller (more negative) for synthetic images than for natural images, while the relative differencing cancels shared content-specific baselines.

4. Semantic Complexity Calibration Module (SCCM)

To eliminate residual bias stemming from extreme texture variations (e.g., highly textured natural images versus ultra-smooth generated images), GLARE incorporates a lightweight, training-free Semantic Complexity Calibration Module (SCCM). Shallow feature maps \(\mathbf{F}(x) \in \mathbb{R}^{H \times W \times C}\) are extracted from the second layer of the VGG network used in the perceptual metric, and their spatial Sobel gradient magnitude is computed to gauge edge density: $\(\rho_{\text{edge}}(x) = \frac{1}{HWC} \sum_{c=1}^C \sum_{i=1}^H \sum_{j=1}^W \|\nabla \mathbf{F}_c(x)[i, j]\|\)$ The calibration factor is defined as its inverse: \(\Phi(x) = \frac{1}{\rho_{\text{edge}}(x) + \epsilon}\). The final forensic score is formulated as: $\(S(x) = \Delta(x) + \log \Phi(x)\)$ A higher \(S(x)\) indicates that the image conforms to natural, low-context-dependence image statistics, signaling a higher likelihood of being a real image.

Loss & Training

GLARE is entirely training-free, requiring no parameter updates, backpropagation, or supervised calibration data. Key implementation specifications include: - Autoencoder Backbone: Built upon the frozen KL-f8 VAE from Stable Diffusion 2.0-base (SD2-base), completely bypassing the diffusion U-Net sampler; - Perceptual Error Metric: Implements LPIPS with features extracted from the second layer of a pretrained VGG-16 network; - Patch Dimension Hyper-parameter: Standard patch size is configured to \(p = 128 \times 128\) pixels. Zero-padding is applied when spatial dimensions are not multiples of \(p\), and reconstructions are cropped back to original dimensions.

Key Experimental Results

Main Results

GLARE is evaluated across three rigorous benchmarks encompassing over 20 generative models, compared against five competitive supervised methods (NPR, FatFormer, AIDE, FIRE, ForgeLens) and six training-free baselines (AEROBLADE, RIGID, ZED, Manifold Bias, WaRPAD, ConV).

1. Evaluation on LDMFakeDetect Benchmark (9 Diverse Generators)

Method	Type	SD (AUROC/AP)	Midjourney (AUROC/AP)	Flux (AUROC/AP)	Würstchen (AUROC/AP)	Mean AUROC (%)	Mean AP (%)
NPR	Supervised	84.50 / 86.82	78.43 / 79.85	82.84 / 85.29	86.48 / 88.30	72.78	73.92
FatFormer	Supervised	70.88 / 68.09	82.73 / 80.50	47.57 / 44.73	91.26 / 90.28	76.51	74.07
AIDE	Supervised	92.86 / 93.62	81.14 / 84.62	94.61 / 94.56	97.77 / 97.60	93.27	93.20
FIRE	Supervised	85.24 / 78.68	84.84 / 77.64	86.04 / 80.52	83.31 / 76.19	84.85	77.94
ForgeLens	Supervised	99.94 / 99.95	91.19 / 91.26	81.74 / 81.72	100.00 / 100.00	89.45	89.55
AEROBLADE	Training-Free	98.14 / 96.98	99.67 / 99.18	77.26 / 77.87	90.80 / 88.55	91.54	89.52
RIGID	Training-Free	61.37 / 59.62	73.66 / 77.46	59.59 / 59.65	66.25 / 67.22	64.66	65.18
ZED	Training-Free	65.73 / 72.14	70.09 / 70.52	63.90 / 67.41	65.55 / 69.86	75.04	77.67
ConV	Training-Free	67.86 / 66.48	84.78 / 84.16	29.06 / 37.68	96.08 / 96.35	79.87	80.51
GLARE (Ours)	Training-Free	99.23 / 99.22	99.96 / 99.97	96.87 / 96.35	96.63 / 96.19	98.13	97.87

2. Cross-Model FakeInversion & In-the-Wild Chameleon Benchmarks

Benchmark	Metric	AIDE (Supervised)	ForgeLens (Supervised)	AEROBLADE (Training-Free)	ConV (Training-Free)	GLARE (Ours)	Relative Gain over 2nd Best Training-Free
FakeInversion (Mean over 13 generators)	Mean AUROC (%)	85.05	85.58	69.98	79.06	92.07	+13.01%
	Mean AP (%)	84.78	85.64	62.08	80.54	88.11	+7.57%
Chameleon (In-the-wild benchmark)	AUROC (%)	71.62	52.14	67.78	46.15	82.62	+14.84%
	AP (%)	66.02	52.19	52.10	51.51	76.97	+10.94%

Ablation Study

The component ablation on the complete LDMFakeDetect benchmark isolates the relative contributions of each module:

Configuration	\(e_f(x)\)	\(e_p(x)\)	\(\Phi(x)\)	AP (%)	AUROC (%)	Note
Global only (\(e_f\))	✓	✗	✗	89.52	91.54	Equivalent to single-path AEROBLADE baseline; conflated by content complexity
Local only (\(e_p\))	✗	✓	✗	70.38	70.11	Stitched patch errors without context reference fail to discriminate
Dual-path \(\Delta(x)\)	✓	✓	✗	96.66	96.82	Relative differencing removes content baselines, boosting AUROC by +5.28%
Full GLARE \(S(x)\)	✓	✓	✓	97.87	98.13	Edge calibration mitigates texture residuals, achieving optimal performance

Parametric and architectural explorations further reveal: - Patch Size Sensitivity: \(p=32\) yields only 90.48% AUROC due to boundary stitching artifacts; \(p=256\) drops to 92.02% because excessive global context is retained within large patches; \(p=128\) attains the peak AUROC of 98.13%. - VAE Backbone Invariance: Replacing SDv2-base with SDv1-1, SDv1-4, or Kandinsky 2.1 preserves high AUROC values between 96.97% and 98.13%, verifying that the detection cue originates from LDM generation dynamics rather than VAE-specific artifacts.

Key Findings

• Log-Ratio Differencing Eliminates Content Bias: Relying solely on \(e_f\) yields 91.54% AUROC, whereas contrasting global against local reconstruction elevates AUROC to 96.82%. The self-referential ratio cancels intrinsic texture complexity baselines that typically fool absolute-error detectors.
• Superior Generalization to Unseen Generator Paradigms: On the novel flow-matching architecture Flux.1, AEROBLADE falls to 77.26% AUROC and ConV collapses to 29.06%, while GLARE sustains 96.87%. On the autoregressive latent model aMUSEd, GLARE scores 98.61% AUROC, confirming the generality of context sensitivity across latent generative architectures.
• Resilience Under Post-Processing Perturbations: Across center cropping, JPEG compression, Gaussian blur, and Gaussian noise, GLARE maintains significantly higher AP than AEROBLADE, RIGID, and Manifold Bias across all severity levels.

Highlights & Insights

• Information-Theoretic Grounding: Links empirical forensic artifacts to rate-distortion theory, demonstrating analytically that autoencoder distortion tracks conditional entropy and exposing why LDM inter-patch mutual information leads to sharp degradation under context removal.
• Lightweight, Training-Free Architecture: Operates purely with two forward passes through an off-the-shelf VAE without requiring reverse-time diffusion sampling or multi-step U-Net iterations, drastically reducing latency and memory overhead compared to perturbation-based methods.
• Self-Calibrated Differential Paradigm: The concept of probing context dependence via global-versus-isolated reconstruction provides a versatile template extendable to video temporal coherence auditing or LLM hallucination tracking.

Limitations & Future Work

• Admitted Limitations: Patch-based partitioning introduces boundary stitching artifacts that can perturb fine-grained spatial error maps; moreover, the method is designed for latent-space models and can be diluted by heavy downsampling compression or non-latent generation architectures.
• Identified Boundaries: Very low-resolution inputs (e.g., \(128 \times 128\)) cannot be meaningfully subdivided without severe border artifacts. Additionally, the SCCM edge proxy relies on VGG shallow gradients, which may provide suboptimal scaling on flat or stylized digital artwork.
• Future Directions: Exploring overlapping or soft-windowed patch extraction to eliminate seam artifacts, and extending the spatial context differencing paradigm to temporal video frames for universal deepfake video detection.

Related Work & Insights

• vs AEROBLADE: AEROBLADE relies on a single absolute VAE reconstruction error \(e_f\). GLARE demonstrates that absolute distortion conflates texture complexity with generation artifacts; introducing local patch error \(e_p\) and log-differencing improves mean AUROC from 91.54% to 98.13% on LDMFakeDetect and from 67.78% to 82.62% on Chameleon.
• vs RIGID / ConV: Perturbation-based detectors perturb inputs and probe DINOv2 invariance, suffering from extreme sensitivity to perturbation choices and domain drift. GLARE probes intrinsic LDM synthesis traces directly without artificial perturbations.
• vs Supervised Detectors (ForgeLens / AIDE): While supervised detectors excel on training distributions, they overfit specific artifacts and degrade on unseen generators or in-the-wild data (e.g., ForgeLens attains only 52.14% AUROC on Chameleon). GLARE achieves 82.62% on Chameleon and exceeds all supervised baselines on FakeInversion by 6.49% without any training.

Rating

• Novelty: ⭐⭐⭐⭐⭐ [Pioneers the concept of elevated context dependence in LDMs and operationalizes it via an elegant global-local rate-distortion probe]
• Experimental Thoroughness: ⭐⭐⭐⭐⭐ [Validates across 20+ generators and 3 benchmark datasets with thorough ablations and robustness stress tests]
• Writing Quality: ⭐⭐⭐⭐⭐ [Clear mathematical derivation, coherent motivation, and meticulous visual presentation]
• Value: ⭐⭐⭐⭐⭐ [Provides a training-free, computationally efficient, highly generalizable forensic tool with high practical deployment utility]