无训练AI生成图像检测器有多脆弱？对分数方向、预处理和压缩的受控审计
How Fragile Are Training-Free AI-Generated Image Detectors? A Controlled Audit of Score Direction, Preprocessing, and Compression
AI总结：
本文通过统一协议审计两种无训练检测分数（自编码重建和噪声扰动特征相似性）及kNN基线，发现实现细节、分数方向选择和数据集格式偏差会导致AUROC变化高达0.38，且简单融合无法超越最佳单分数。
摘要：
无训练的AI生成图像检测器承诺无需分类器训练即可实现生成器无关的部署，但其报告的数字很少在单一受控协议下进行比较。我们审计了两种代表性的无训练分数——一种自编码器重建分数（AEROBLADE风格）和一种噪声扰动特征相似性分数（RIGID风格），外加一个朴素的特征kNN控制，在包含七个生成器和JPEG压缩质量70和50的公共1,500图像GenImage衍生基准上进行。审计得出三个警示性发现。（i）实现细节伪装成方法差异：将LPIPS骨干网络（AlexNet -> VGG-16）替换使整体AUROC变化+0.085，在resize-to-512和原始分辨率预处理之间切换使每个生成器的结论翻转高达0.38 AUROC。（ii）分数方向不是方法的属性而是其超参数的属性：RIGID风格分数在噪声水平sigma=0.05时对SD1.5和Wukong反转（AUROC < 0.5），在sigma=0.01时对所有生成器恢复至>0.5，在sigma=0.3时降至0.15。（iii）数据集格式偏差夸大鲁棒性声明：没有统一重新编码时，JPEG-50下的AUROC超过AlexNet骨干重建分数的干净条件；偏差校正后残余异常定位到单个生成器（BigGAN）。审计的分数具有互补的逐生成器失败集，但朴素z-score融合未能击败最佳单分数，表明利用互补性需要方向感知的组合。
英文摘要：
Training-free detectors of AI-generated images promise generator-agnostic deployment without classifier training, yet their reported numbers are rarely compared under a single controlled protocol. We audit two representative training-free scores -- an autoencoder-reconstruction score (AEROBLADE-style) and a noise-perturbation feature-similarity score (RIGID-style) -- plus a naive feature-kNN control, on a common 1,500-image GenImage-derived benchmark spanning seven generators and JPEG compression at quality 70 and 50. The audit yields three cautionary findings. (i) Implementation details masquerade as method differences: replacing the LPIPS backbone (AlexNet -> VGG-16) changes overall AUROC by +0.085, and switching between resize-to-512 and native-resolution preprocessing flips per-generator conclusions by up to 0.38 AUROC. (ii) Score direction is not a property of the method but of its hyperparameters: the RIGID-style score is inverted (AUROC < 0.5) on SD1.5 and Wukong at noise level sigma=0.05, recovers to >0.5 for every generator at sigma=0.01, and collapses to 0.15 at sigma=0.3. (iii) Dataset format bias inflates robustness claims: without unified re-encoding, AUROC under JPEG-50 exceeds the clean condition for the AlexNet-backbone reconstruction score; after bias correction the residual anomaly localizes to a single generator (BigGAN). The audited scores have complementary per-generator failure sets, but naive z-score fusion does not beat the best single score, indicating that exploiting complementarity requires direction-aware combination.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
