Detection of generated images

Abstract

Determine whether the input image is a real image or a computer-generated image. [Solution] A computer-implemented method for detecting computer-generated images, comprising: loading an input image; inputting the input image and a representation describing the input image into a denoising model for denoising the input image using the representation; generating a denoising image embedding from the denoising image; generating an input image embedding from the input image; and determining whether the input image is a real image or a computer-generated image by comparing the difference between the input image embedding and the denoising image embedding with a similarity threshold. Methods that include...

Description

[Technical Field]

[0001] The present invention relates to a method and apparatus for detecting computer-generated images. [Background technology]

[0002] Generative AI (GenAI) technology has advanced significantly in recent years. The current capabilities of GenAI technology have progressed to the point where images generated by AI (artificial intelligence) / artificial neural networks (ANNs) can appear real to the human eye. As Generative AI (GenAI) technology continues to advance, its use in creating fake content, particularly fake images, is increasing. This can be used to spread high-quality fake content. Therefore, distinguishing between real and fake images is a critical challenge. According to a new report by MarketsandMarkets (Non-Patent Literature 1), the fake image detection market is projected to grow from US$600 million in 2024 to US$3.9 billion by 2029, at a CAGR of 41.6%. [Non-Patent Document 1] https: / / www.prnewswire.com / news-releases / fake-image-detection-market-worth-3-9-billion-by-2029---exclusive-report-by-marketsandmarkets-302105477.html [Accessed 04 September 2024]

[0003] AI-generated image detectors are specifically designed to identify images created or modified by artificial intelligence techniques, such as deepfakes or AI-generated artwork. The motivations for developing and using these detectors are multifaceted.

[0004] 1. Integrity and Trust: As AI technology becomes more sophisticated, it will become increasingly difficult to distinguish between real images and AI-generated images. Detectors are needed to maintain the integrity of visual information and ensure that what people see in the media and online is trustworthy.

[0005] 2. Security Concerns: AI-generated images can be maliciously used to create false information or impersonate individuals, potentially leading to security breaches, misinformation, or personal harm. Detectors help prevent such threats by identifying and flagging synthetic media.

[0006] 3. Regulatory Compliance: As regulations on digital content increase, companies and content creators need to ensure compliance with transparency laws regarding AI-generated content. Detectors can help automatically identify such content, label it appropriately, or assess its legality.

[0007] Therefore, it is desirable to develop methods for detecting computer-generated images. In particular, it is desirable to develop methods for detecting images generated using artificial neural networks. [Overview of the Initiative] [Problems that the invention aims to solve]

[0008] The present invention is defined in the independent claims, which are to be referenced herein. Advantageous features are described in the dependent claims. [Means for solving the problem]

[0009] According to a first aspect, there is provided a computer-implemented method for detecting a computer-generated image, the method comprising: loading an input image; inputting the input image and a representation describing the input image into a denoising model for denoising the input image using the representation; generating a denoised image embedding from the denoised image; generating an input image embedding from the input image; comparing the difference between the input image embedding and the denoised image embedding with a similarity determination threshold to determine whether the input image is a real image or a computer-generated image.

Brief Description of the Drawings

[0010] By way of example only, reference is made to the accompanying drawings. [Figure 1a] Shows a known method for detecting computer-generated images. [Figure 1b] Shows a comparison of the accuracy rates of various known methods for fake image detection. [Figure 2] Shows fake content detection classification. [Figure 3a] Shows the steps of a method for detecting computer-generated images. [Figure 3b] Shows threshold setting and implementation of a method for detecting computer-generated images [Figure 4] Shows computer-generated content detection classification. [Figure 5] Shows an exemplary architecture for detecting computer-generated images. [Figure 6] Shows an example of a known method for generating an image from noise using a diffusion model. [Figure 7] Shows a method for detecting fake images using a denoising model developed by the inventors. [Figure 8] Shows an exemplary pipeline for detecting computer-generated images. [Figure 9] Shows a simulation of toy data probability in a two-dimensional space. [Figure 10]This specification provides examples of method selection and analysis for implementing the detection methods described herein. [Figure 11] This shows a visual comparison between the denoised generated image and the denoised original image. [Figure 12] This specification presents a sample-dependent evaluation comparing the methods disclosed herein with known methods. [Figure 13] This specification presents technically dependent experiments for evaluating the methods disclosed herein. [Figure 14] a and b illustrate exemplary use cases for the methods described herein. [Figure 15] This specification shows autoencoder models that can be combined with the detector models described herein. [Figure 16] A block diagram of an information processing device or computing device that may be used to implement the methods described herein is shown. [Modes for carrying out the invention]

[0011] Numerous techniques exist for creating fake visual content. Genuine images may be manipulated using “classic” operations such as retouching, editing, and / or alteration, processed using applications such as Adobe Photoshop, and / or edited using model-based operations such as inpainting and generative fill.

[0012] Fake visual content can be generated from scratch, for example, using GENAI models. Fake visual content generated from scratch is sometimes called computer-generated content. Popular GENAI models for generating images include generative adversarial networks (GANs) and diffusion models. The ability to generate fake images has become more accessible with text-image models, which allow users to simply describe the desired image in words.

[0013] Recent advances in generative models, particularly diffusion-based techniques, have resulted in realistic computer-generated images that are increasingly difficult to distinguish from genuine images. This poses significant challenges in content verification, security, and disinformation prevention efforts, driving the demand for reliable mechanisms for detecting AI-generated images. A broad array of modern research focuses on this task, and there is a consensus on the critical importance of generalization in this field.

[0014] Generative technologies are developing rapidly, presenting substantial challenges in keeping generated datasets up-to-date. Therefore, methods that rely on such datasets must be effectively and successfully generalized to new and unknown generative technologies. Targeted efforts to improve such generalization have been actively pursued. In particular, these methods still require data from thousands of diverse generated images (e.g., Non-Patent Document 2) and still rely on updated datasets. This highlights the need for adaptable detection methods that are not dependent on such datasets, such as zero-shot approaches. [Non-Patent Document 2] S.-Y. Wang, O. Wang, R. Zhang, A. Owens, and AA Efros. Cnn-generated images are surprisingly easy to spot... for now. In Proceedings of the IEEE / CVF conference on computer vision and pattern recognition, pages 8695‐8704

[0015] Figure 1a shows a known method 100a for detecting computer-generated images. Techniques for detecting fake images to some extent have existed for a relatively long time. For example, before the start of GENAI, various methods were used to detect manipulated genuine images. Thus, there are numerous effective known solutions available for detecting manipulation in genuine images. However, the field of "generating fake images from scratch" is relatively new. As a result, existing detection methods for detecting manipulation in genuine images are insufficient when applied to these types of images because they cannot be applied to completely generated images.

[0016] The inventors have found that all known methods for detecting computer-generated images (i.e., images generated from scratch) work using essentially the same approach. Known methods may first perform the steps of “Obtain a real image dataset” 110 and “Obtain a generated image dataset” 115. As described in these steps, these methods may, for example, import a real image dataset from an image library, or import or generate a fake image dataset.

[0017] In the extraction step, the method may “perform feature extraction” 120. Feature extraction may be performed using known techniques, for example, by a convolutional neural network or any other suitable NN. In the training step, the method may “train a classifier” 130 to classify input images as either real or fake. Input images may be classified as either real or fake by a fully connected layer of a convolutional neural network.

[0018] While current methods can effectively identify computer images created with known techniques, the inventors have found that these methods often fail when faced with images generated by unfamiliar or novel techniques. This limitation reduces their practicality in real-world scenarios where unknown or novel image generation methods may be used to create deceptive content.

[0019] Figure 1b shows a comparison of the accuracy of various known methods for false image detection. This figure is from Non-Patent Literature 3. Each of the known methods relies on supervised learning techniques; that is, each model is trained using generated images. The y-axis in the figure indicates the type of detector model, and the x-axis indicates the model used to generate computer-generated images for training each model. The accuracy of each model is expressed using the accuracy metric, i.e., the ratio of correct predictions (both true positives and true negatives) to the total number of cases examined. In general, in this field, the performance of a method can be evaluated by the accuracy, f1, or AUC metric. Specifically, in this figure, the accuracy metric was used for evaluation. [Non-Patent Document 3] Epstein, DC, Jain, I., Wang, O., & Zhang, R. (2023). Online detection of ai-generated images. In Proceedings of the IEEE / CVF International Conference on Computer Vision (pp. 382-392)

[0020] The evolution of AI-generated image detection techniques has primarily relied on supervised learning methodologies. A common approach utilizes standard CNNs trained on a mixture of real and generated images to distinguish between them. Building on this, subsequent research has advanced these techniques by identifying and integrating key phenomenological features that enhance the distinction between real and generated images. However, these approaches rely on broad datasets of generated images, limiting their generalizability to new and unknown generative techniques.

[0021] Recent research has proposed alternative methods to enhance generalization when detecting images created by unknown generative techniques. Unsupervised and semi-supervised methods attempt to reduce reliance on broadly labeled datasets. However, they still rely on access to various generative methods during training, introducing bias toward those methods. Despite various methods attempting to improve generalizability, the field still struggles with the challenges of rapid technological evolution and generalization across unknown models, both in generalization and constrained data settings.

[0022] The inventors have found that existing detection methods have primarily focused on analyzing the image itself, rather than the behavior when faced with model fingerprints or images. This limits their effectiveness against evolving, more sophisticated image generation methods such as diffusion models.

[0023] As shown in the figure, the accuracy of each model decreased when input test images were generated using techniques different from those used in the model's training. Current models tend to fail to detect unknown techniques, making them impractical for real-world threats.

[0024] Figure 2 shows the fake content detection classification 200. The inventors identified the following categories that can be considered for the detection method.

[0025] Content Type 210: Detected generated content may be presented in various forms, such as generated images (e.g., fake celebrity photos), generated text (e.g., phishing emails), and generated audio files (e.g., fake recorded phone calls).

[0026] Content creation origin 215: Detected generated content may be created by manipulating existing content (e.g., real images, existing text, etc.) or it may be generated from scratch.

[0027] Content Domain 220: Detected generated content may relate to different knowledge domains.

[0028] Prior exposure to generated content 225: The detector model may be exposed to computer-generated (fake) content during its training / calibration process.

[0029] Prior exposure to authentic content 230: The detector model may be exposed to authentic content during its training / calibration process.

[0030] Calibration Process 235: How the detector is trained / calibrated. Fully supervised – The detector is trained by learning to separate real and fake content while being exposed to classes of both real and fake content. Single-class training – The detector is trained by learning the characteristics of only one class (real or fake) while being exposed to only one class. Setting the decision threshold—the detector is not trained; only the decision threshold is set according to a small, predefined set of samples.

[0031] Figure 3a shows the steps of method 300a for detecting computer-generated images, developed by the present inventors. The steps of this method may be performed by a computer and, therefore, may be computer-implemented. Computer-generated images can be fake images; that is, computer-generated images may be images generated by artificial intelligence / artificial neural networks. Therefore, computer-generated images are sometimes called fake images or artificially generated images.

[0032] Computer-generated images may be generated from scratch. Computer-generated images may be generated from prompts such as text prompts. Computer-generated images may be generated from scratch in the sense that the generated image is not the result of editing or manipulating an existing image. A fake image may be an image generated by an artificial neural network. An AI / artificial neural network does not have to use an input image to generate an image; that is, a real image does not have to be used as a prompt for the neural network (but of course, an existing image may be used to train the AI / ANN to generate computer-generated images).

[0033] In loading phase s10, input images may be loaded. For example, an image of interest whose authenticity is unknown may be loaded. Input images may be loaded automatically. For example, input images may be searched for or scraped from web pages such as news outlets or social media. Alternatively, input images may be entered by the user.

[0034] In input step s20, an input image and a representation describing the input image may be input to a denoising model for denoising the input image using the representation. The denoising model may be a pre-trained denoising model. For example, the denoising model may be a pre-trained diffusion model (e.g., a denoising diffusion probabilistic model, DDPM). The input image may be denoised by the denoising model using the representation. That is, the denoising model may take the representation as input, denoise the input image, and generate a denoised input image.

[0035] The representation describing an image may be a text description of the image. The text description may be generated using, for example, an image-text model. An example of an image-text model used to generate a text description is nlpconnect / vit-gpt2-image-captioning. The image-text model can receive an input image and generate a text description of the image. The representation may be loaded as input along with the image. For example, the input image and representation may be input by the user.

[0036] Alternatively, the input image may be provided as the sole input (for example, by the user), and the representation (for example, a text description) may be generated or loaded using, for example, an image-to-text model. That is, the image-to-text model may be an internal model used in this method. The inventors have found that the method becomes more practical by requiring only an image as input. That is, the method is more practical in the sense that the user does not need to generate a text representation externally and input that representation along with the image.

[0037] Further examples of representations describing an image may include scene graphs, scene graph triplets, and / or labeled bounding boxes around objects in the input image. Of course, any appropriate modality may be used as such representation.

[0038] The aforementioned representation may be tokenized and / or converted into an embedding before being input to the denoising model.

[0039] One example of a denoising model is the stable diffusion model (CompVis / stable-diffusion-v1-4). The diffusion model may be stored locally. For example, the diffusion model may be stored on the computer that runs the steps of the computer-implemented method. Alternatively, the diffusion model may be stored remotely, for example, in the cloud or on a network, and may be accessed remotely when the method is run. In one example, the entire system (for example, the system that implements the method) may be hosted in the cloud. In this setup, a user can upload an image, for example, via an API, and the system can then analyze it and respond whether the image is computer-generated or real.

[0040] Denoising models can be primarily trained on real images. These real images may be imported or received from a database of real images. Alternatively, denoising models may be trained solely on real images; therefore, they are sometimes called pre-trained denoising models. The detection method, in one example, is sometimes called the zero-shot method because the model is not exposed to computer-generated images for training.

[0041] The input image can be denoised by a single-item denoising step; that is, the input image can be denoised only once by the denoising model.

[0042] In generation step s30, the denoised image embedding may be generated from the denoised image (i.e., from the denoised image output from the denoising model). The denoised image embedding may be generated by inputting the denoised image into an image autoencoder. For example, a CLIP embedding (Contrastive Language-Image Pretraining, CLIP) may be generated as the denoised image embedding (Non-Patent Literature 4). That is, the image may be converted into a multimodal embedding. For example, the text describing the scene and the image of the scene may be assigned the same or substantially similar multimodal embedding, as in the case of the CLIP embedding. The denoised image embedding may be generated using an image encoder such as the CLIP image encoder. [Non-Patent Document 4] Radford, A., Kim, JW, Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J. and Krueger, G., Learning transferable visual models from natural language supervision. In International conference on machine learning (pp. 8748-8763). PMLR, 2021, July

[0043] In another generation step s40, an input image embedding can be generated from the input image. The input image embedding may be a CLIP embedding. The input image embedding can be generated using an image encoder such as a CLIP image encoder. Therefore, the input image embedding and / or denoising image embedding can be generated using an image encoder.

[0044] In comparison step s50, the difference between the input image embedding and the denoised image embedding is compared with a similarity threshold to determine whether the input image is a real image or a computer-generated image.

[0045] The real image may be an image captured by an imaging device such as a camera. That is, the real image may be a still image from a photograph and / or video. The real image may be unedited / unmanipulated. The real image may be captured by a digital camera and / or smartphone and therefore may be produced in a digital format. Additionally or alternatively, the photograph may be captured using a film camera or any other analog method and converted to a digital photograph (for example, by scanning).

[0046] The difference between the input image embedding and the denoised image embedding can be expressed as cosine similarity or a cosine similarity score. For example, the similarity threshold can be set based on the mean and standard deviation of similarity between the original image and the corresponding denoised original image. The denoised image can be denoised by a denoising model. For example, in the initialization step, original images, e.g., 1000 original images, may be input to the denoising model. The denoising model can denoise each of the original images to generate a denoised image. The sum of the mean similarity of each original image to its corresponding denoised image, plus the standard deviation, can be used as the similarity threshold. The similarity may be, for example, cosine similarity. Alternatively, one, two, or three or more standard deviations may be added to the mean similarity for the similarity threshold.

[0047] If the difference between the input image embedding and the denoised image embedding is higher than the similarity threshold, the input image may be determined to be fake. If the difference between the input image embedding and the denoised image embedding is lower than the similarity threshold, the input image may be determined to be genuine.

[0048] This method can detect computer-generated (fake) images and identify "fake" image classes by modeling the distribution of "real" image classes.

[0049] This method can utilize an adapted version of the denoising process of a (stable) diffusion model to take advantage of the unique characteristics of "fake" images.

[0050] If the method determines whether an input image is a real image or a computer-generated image, it may further include outputting whether the input image is a real image or a computer-generated image on a graphical user interface (GUI). The GUI may be displayed on a screen or display such as a computer monitor. The user can interact with the GUI and be presented with the determination.

[0051] This method can be used to verify whether an input image is a computer-generated image. For example, a preliminary determination that the input image is a computer-generated image may be performed by another detection model, and the method using the denoising model described herein may be used for verification. The other detection model may be used before inputting the representation and the input image into the denoising model.

[0052] Therefore, before inputting the aforementioned representation and input image into the denoising model, the following steps may be performed: a step of converting the input image into an input image embedding; a step of inputting the input image embedding into a pre-trained image autoencoder, wherein the training images of the pre-trained image autoencoder are mainly real images; a step of generating an autoencoder embedding of the input image embedding as the output of the autoencoder; and a step of performing a preliminary determination that the input image is a computer-generated image by comparing the difference between the input image embedding and the autoencoder embedding with an autoencoder determination threshold. Further details of the alternative detection model and the further steps described above are explained in relation to Figure 15 below.

[0053] The methods described herein may have the following advantages: Pioneering approach: Leverages the unique properties of "fake" images by utilizing a customized version of the denoising process of a stable diffusion model. Modernization by design: Images generated by new generation techniques can be detected without any changes or updates to the detection process. No access to any corpus of generated images is required—this results in a low-conservative generation-generic detection method. Minimal access to a corpus of real images is required to set the similarity threshold.

[0054] Figure 3b shows a combined threshold setting and implementation of the method described herein. The right side of the figure shows an exemplary implementation of the method described in relation to Figure 3a above.

[0055] The left side of the figure shows the settings for the similarity threshold (referred to as the denoising similarity threshold in the figure). As shown in the figure, the similarity threshold can be set using real images; that is, images whose authenticity has been verified. The threshold may be set before the detection method is implemented.

[0056] As shown in the figure, threshold setting may follow a method substantially similar to that of the implementation method. The inventors performed a single denoising iteration using a pre-trained diffusion model. For threshold calibration, 1000 real images were selected and processed according to the method pipeline described above. For example, images are loaded from a real image corpus, image representations are loaded / generated, and in this example, text descriptions of images are generated using an image-to-text model. The images and representations are input to a denoising model and denoised using a single denoising process. Embeddings, in this example CLIP embeddings, are generated for the input real images and the denoised real images, and the similarity determined from these two embeddings is used to set the similarity threshold. In particular, the similarity threshold used the mean and standard deviation (i.e., +1 std) of the similarity of the 1000 real images. Similarity was determined using cosine similarity. The determined similarity threshold was set as the similarity threshold for the implementation of the method. The inventors verified that 1000 genuine images were indeed genuine by selecting images taken before the GenAI era (i.e., before 2014). The inventors empirically selected the number of images (1K).

[0057] The method and detector model developed by the inventors can identify generated images based on their similarity to a denoised version. The method and model may utilize a customized denoising process from a stable diffusion model to leverage the unique characteristics of the generated images. This method and model may only be exposed to real images during the training and thresholding of its components. Furthermore, the method and model can leverage and customize the denoising process of a stable diffusion model to enable the detection of images generated by novel, unknown generative techniques, perform novel customizations of the generative process of a text-based image model for detection purposes, and customize the denoising process to revise new representations of the examined images.

[0058] The inventors had complete control over the calibration image dataset. Images in the dataset could be selected for calibration only if it was certain or substantially certain that they were not computer (or machine) generated. In one example, if the calibration set was not pre-validated (e.g., the dataset was provided externally), the calibrated output of 1000 images could be analyzed to remove outliers that might be derived from machine-generated images. While the inventors used 1000 images, of course, any suitable number of images (e.g., any number that yield statistically significant results for similarity scores) could be used.

[0059] While the inventors used only real images, it can be understood that the method may still be valid even if the calibration dataset primarily consists of real images, with a small number of images (e.g., less than 10% or less than 5%) being artificially generated. This allows for the accidental inclusion of spurious images in the training dataset. For example, if there is only one or a small number of computer-generated images in the calibration set, the impact on the threshold may be negligible and may not impair detection performance. If there are more than a small number of computer-generated images, these images may be omitted by simple outlier removal.

[0060] The training method for training the denoising model is not shown in the figure. As mentioned above, the denoising model used by the inventors was a diffusion model. In particular, the inventors used a latent diffusion model. The latent diffusion model used by the inventors was a conditioned latent diffusion model. An example of a conditioned latent diffusion model is a stable diffusion model. A stable diffusion model is conditioned on text input.

[0061] The denoising model used by the inventors was a pre-trained diffusion model. A pre-trained diffusion model, such as a stable diffusion model, can be trained primarily on real images. In one example, the diffusion model may be trained on real images only. Of course, the diffusion model may also be trained on a mixture of real and generated images, or on generated images only. The similarity threshold can vary depending on the dataset used to train the denoising model. The inventors used a pre-trained diffusion model trained on real images only. The inventors found that current diffusion models tend to be trained on real images only.

[0062] The diffusion model may be trained during the forward process. The diffusion model can be trained, for example, by loading training images from a training image dataset, generating random noise representations, adding these random noise representations to the training images one or more times, and adjusting the weights of the noise predictor in a denoising model (e.g., the diffusion model) to predict the random noise representations added to the images. This process may be repeated for each training image in the training image dataset.

[0063] A noise predictor can be trained by exposing it to training images and adjusting its weights to minimize the error. The noise predictor may be included in the UNet architecture. The random noise may be k-dimensional random noise. The random noise may have the same dimensions as the training images. The training process may be iterated for each training image.

[0064] Training may be performed in latent space. The training image may be a 512×512×3 image. The training image may be transformed into a latent size of 64×64×4. Training may be performed in latent space using a variational autoencoder (VAE). The variational autoencoder may comprise an encoder and a decoder. The encoder may transform the training image into a latent representation, and the decoder may transform the latent representation into the same size as the original training image.

[0065] Therefore, in the latent space, the training image can be represented by a tensor in the latent space, which can be called the training image latent tensor. The random noise representation can also be represented by a tensor in the latent space, and therefore can be called the random noise latent tensor.

[0066] Figure 4 shows a computer-generated content detection classification 400 for a method developed by the inventors. For example, the method described herein in relation to Figure 3 may be classified as follows:

[0067] Content type 410: Detected generated content can be input to the detector model as an image.

[0068] Content Creation Origin 415: Generated content (generated images) may be generated from scratch [may be generated from zero]. For example, generated content may be created by an AI / NN model. Content may be generated from user prompts, such as a description of a desired image.

[0069] Content Domain 420: The generated content may relate to a different knowledge domain, in this case, photography. That is, the input image may be a fake, generated image in the style of a real image taken using an imaging device.

[0070] Prior exposure to generated content 425 / Prior exposure to real content 430: The detector model may be trained primarily with real images. Preferably, the detector model may be trained with real images only (no fake images).

[0071] Calibration process 435: The detector may be trained on only one class (real images) and learn the characteristics of that class. Furthermore, a set decision threshold may be used, for example, a (pre-trained) denoising model, and the decision threshold may be set according to a small predefined set of samples, as described above.

[0072] Zero-shot detection of text generated via Large Language Model (LLM) analysis has been successfully used to identify text generation. In a zero-shot setting, a pre-trained model is used to solve a task it has not been trained for, without further training. That is, these methods leverage the model's knowledge beyond its pre-training data. Recognizing that this type of technique can be valuable in the image domain, the inventors have developed a method for detecting spuriously generated images in a zero-shot setting.

[0073] Figure 5 shows an exemplary architecture 500 for detecting computer-generated images. The architecture may correspond to the method described in relation to Figure 3 above and may also be called a detection model. Each item in the figure may be called a block or module (for example, a "CLIP image encoder" block or an "image-to-text model" module). As described above, this method can perform detection according to similarity with a denoised image.

[0074] Input image 510 may be input to the model. It may be unknown whether the input image is a real image or a fake computer-generated image.

[0075] The input image may be received by the CLIP image encoder 520. The input image may be converted into a CLIP embedding 525 by the CLIP image encoder. Although the inventors used the CLIP image encoder, of course, any suitable image encoder can be used. Of course, the embedding produced by the image encoder may depend on the image encoder used.

[0076] The input image may be input to an image-text model. The image-text model can generate an image caption or description of the input image. The image-text model used by the inventors was the nlpconnect model (nlpconnect / vit-gpt2-image-captioning). The model was obtained from the huggingface website (https: / / huggingface.co / [accessed September 6, 2024]). As shown in the figure, an image description for an exemplary input image may be "a trio of bright pink flowers, each with five petals, set against a green background."

[0077] The image description may be input along with the input image to a denoising model (for example, a single-item denoising step 540 shown in the figure). The denoising model may be a diffusion model, which will be described in more detail in relation to Figures 7 to 11 below. The denoising model may take the input image and description and denoise the input image only once based on the description. That is, the input image may be denoised in a single iteration.

[0078] Image descriptions may be preprocessed before being input to the denoising model. For example, descriptions may be tokenized and encoded before input. The inventors preprocessed descriptions using CompVis's text tokenizer and text encoder (CompVis / stable-diffusion-v1-4, obtained from huggingface).

[0079] While text descriptions have been described above, in another example, a diffusion model may accept any suitable representation that describes the input image. The stable diffusion model used by the inventors accepted a text description. However, other denoising models may accept, for example, labeled representations of the image, scene graphs, sketches, and / or labeled bounding boxes.

[0080] The denoising model may output a denoised image 550. The denoised image may be a denoised version of the input image. The denoised image may have the same size and dimensions as the input image.

[0081] The denoised image can be input to an image encoder, such as a CLIP image encoder 560, to generate a denoised (image) embedding 570. The difference between the input image embedding and the denoised image embedding can be compared to a similarity threshold 590 to determine whether the input image is a real or fake image (590) (i.e., whether the image is a computer-generated image).

[0082] The difference between the input image embedding and the denoising image embedding can be determined using similarity. For example, a cosine similarity score may be used to determine the difference between the two embeddings.

[0083] The similarity threshold 990 may be set according to the average similarity between real images plus the standard deviation. For example, the inventors set the similarity threshold using 1000 real images.

[0084] Figure 6 shows an example of a known method 600 for generating an image from noise using a diffusion model. The general principle of the diffusion model is as follows:

[0085] Diffusion model settings Diffusion models are generative models capable of generating high-quality samples in various domains. Diffusion models operate through a sequential iterative generation process of noise reduction based on a pre-set noise schedule.

[0086] Let the data manifold be Ω ⊂ R d . Here, d is the data dimension. Denote the sample as x ∈ Ω. First, sample x T ∼ N(0, I). Each iteration step t involves removing the noise of x t through the neural network f(x t , t; θ) (where θ is the adjustable weight of the neural network, i.e., the diffusion model), and then proceeding to x t-1 . This sequence ends at x0 ∈ Ω, which represents the final output. In this setting, x0 is an image.

[0087] This generation process is known as reverse diffusion. During training, f is optimized to invert the forward diffusion process defined as follows using the scheduling parameter α t ∈ R + for all t and noise ε ∼ N(0, I).

Number

[0088] Score function in diffusion models The score function in the diffusion model can be defined as ∇log p(x). Here, p(x) is the probability of x. Let p αt (x t ) be the probability of x t considering Equation (1). The research by Song and Ermon [2019, 2020], Kadkhodaie and Simoncelli

[2021] , which laid the foundation for the currently known diffusion models, utilized Equation (1) and the score function based on the pioneering result of Miyasawa et al.

[1961]

Number

number

number

number

[0089] Finally, f(x t By replacing ,t;θ) with the true x0, as

number

[1951] .

number

[2019] , the generative process changes over time pαt Taking this into consideration, we generalize equation (4). However, the inventors have found that a fixed α t p about αt Fixed-point analysis was used. Here, the commonly used time is reversed, i.e., a large τ means a small t. The inventors consistently worked with t.

[0090] As shown in Figure 6, in the diffusion model, the encoded prompt and random noise 615 can be fed into the UNet model 630. In this example, the encoded prompt is the description "a light gray sofa with a surreal painting in the background". The prompt is encoded using a text encoder to produce the encoded text 620.

[0091] The UNet model accepts encoded text and random noise as input and processes its output over T iterations 635. That is, in each iteration, the UNet model denoises the random noise as described by the equations above and takes the denoised image from each iteration as input for the next iteration. After a predetermined number of iterations, the final output is decoded into a generated image 645 using the image decoder 640.

[0092] Figure 7 shows a method 700 developed by the inventors for detecting false images using a denoising model. The inventors have developed a single-item denoising process based on a text-to-image stable diffusion model. A representation describing an input image, in this example a text description 710, and an input image 715 can be input to the denoising model as described above. The text description can be generated using an image-to-text model as described in relation to Figure 5. The text description can be encoded using a text encoder to produce encoded text 720. Of course, if the denoising model accepts different modalities or types of input, for example, any suitable representation describing an image can be input to the denoising model.

[0093] The encoded text 720 and the input image can be input to the denoising model UNet model 730. In contrast to known denoising methods, in the single-iteration denoising process developed by the inventors, random noise (e.g., random noise 615 in Figure 6) is replaced by the input image. The UNet model receives the input image and performs only one iteration; that is, the UNet model denoises the input image only once. This "reduces" the "noise" in the input image that is irrelevant to the prompt, i.e., the input is denoised.

[0094] The denoised input image representation can then be input to a denoised image decoder to decode and generate a denoised image 745.

[0095] Furthermore, an input image embedding may be generated for the input image. For example, an image encoder such as a CLIP encoder may be used to generate the CLIP embedding. Similarly, a denoising image embedding may be generated for the denoising image. The (CLIP) embeddings of the input image and the denoising image can then be compared to a similarity threshold.

[0096] The inventors have found that by adapting a denoising model to perform a single denoising iterative step, the method described herein can effectively detect computer-generated images. That is, the method developed by the inventors may be for detecting images synthesized by a computer, for example, by generative synthesis.

[0097] The rationale and mathematical proof for the effectiveness of the method developed by the inventors are as follows:

[0098] The inventors identified the possibility of avoiding problematic datasets in the image domain by using a generative model pre-trained on scraped real data (i.e., authentic images).

[0099] The inventors have found that generated images and real images can be characterized in zero-shot settings by integrating the perspective of the theoretical score function of the diffusion model with a non-Euclidean manifold. In this case, a zero-shot setting can be understood as a setting in which the task performed by the model was not presented to the model during training. For example, the method described herein may use the model to perform detection (of generated images), and the model may not be trained to do so (i.e., the model may not be exposed to generated images during training).

[0100] When employing such frameworks for image generation techniques, inherent challenges arise. Current dominant image generation methods, namely diffusion models and generative adversarial networks (GANs), are implicit in their probabilities; that is, they do not explicitly provide the probabilities of the generated images, but instead learn to sample high-probability samples from an implicit data manifold. For this purpose, the inventors used a pre-trained diffusion model for its ability to approximate a score function with respect to probability density p. S = ∇ log p (5)

[0101] The inventors analyzed a manifold defined by a functional surface log p. Surface curvature H

number

[2006] and Kimmel et al.

[1997] for details on the relationship of total-variation energy to (negative) subgradients. Unlike S, accessing H is not straightforward. The inventors have developed a mathematically established method for accessing such properties in an image generation setting and have devised a zero-shot framework for generated image detection that performs better than current techniques in data-constrained regimes (see, for example, Figures 3, 5, and 8a and b). This specification provides a theoretical perspective on combining classical manifold analysis techniques with a diffusion model score function. As a result, the inventors have developed a method for distinguishing between generated images and real images.

[0102] Figure 8 shows an exemplary pipeline 800 developed by the inventors for detecting computer-generated images. The figure illustrates the concept based on the mathematical foundation of the method, in particular, the use of spherical perturbation as described below. The proposed zero-shot detection pipeline can avoid the need for computer-generated data for training. The input image x0 can be subjected to a pre-trained diffusion model and spherical perturbation. This sets up a step for the mathematical characterization of x0 as described below and provides a criterion for determining whether the input image is computer-generated.

[0103] A noisy image may be the input to a denoising model. The noise may be derived from a spherical distribution. While this deviates somewhat from the usual Gaussian noise distribution used in diffusion models, the inventors have found that it can facilitate mathematical analysis and can be very similar to Gaussian noise. This similarity is sometimes called "concentration of measure."

[0104] Fixed point geometric analysis Considering the explanation provided in relation to Figure 6 above, the generated sample x0 can be expected to be a stable maximal in the learned log-stochastic manifold according to equation (6). Thus, x0 can be expected to be a point with positive curvature and a low gradient in its domain. Conversely, real data points that are unlikely to be generated do not exhibit these properties. Essentially, the learned manifold can be expected to be more "bumpy" than the actual data manifold, and the generated data appears as peaks on the surface of this bumpiness. An illustration of this idea is provided in relation to Figure 9. To test x0 for these properties, the inventors worked in a local neighborhood of x0. Using fixed-point analysis, the generation process was "frozen" to a small t. α t is, p αt is small enough to approximate the data distribution, p αt It was assumed that it was large enough to be smooth. Since t is fixed, α can be used (without t) from this point onward. α Due to its smoothness, log p α Using R d+1 The d manifold embedded in (x, log p α It can be constructed as a parametric hypersurface of the form (x). Here, the total variation curvature of equation (6) is applied.

[0105] Let B0 be the local neighborhood of x0 and ∂B0 be its boundary, with volumes |B0| and |∂B0| respectively. 〈,〉, and ||·||² represent the Euclidean inner product and norm. The inventors have developed a gradient criterion and a curvature criterion.

number

number

[0106] The inventors believe that this B0 may be practical.

number

number

[0107] Clarification: ∇log p αt ( ) can be applied to samples of x with a tilde, but the inventors have made a score function and its denoising agent so that it is x t The calculation was performed assuming that the data was sampled from [source]. Therefore, equations (2) and (3) still hold. That is,

number

[0108] α←α t x and x with a tilde are constructed t Note the close relationship between them. As d increases, the probability of ||ε||² (ε in equation (1)) converges around its mean √d, reducing the stochastic nature of the norm, and u d and ε (and as a result x and x with tildes) t Make x interchangeable in higher dimension d. See also Laurent and Massart

[2000] , Figure 10. Thus, x t A model trained to remove noise is, in the sense of equation (3)

number

number

[0109] Figure 9 shows a simulation of toy-like stochastic surfaces, specifically, toy-like data probabilities in a two-dimensional space (d=2) structured along a one-dimensional manifold (Ω is a curve). The subfigures of Figure 9 are as follows:

[0110] (a) Log-probability surface of the perturbed sample, considering uniform probabilities on the Ω curve. (b) Simulation of the hypothesis that the generative model learns a bumpy version of the manifold: bumps are randomly assigned to the manifold and visualized in color on the original surface. (c) The resulting bumpy surface. (d) Magnitude of the gradient of the bumpy manifold. (e) Total variation curvature of the bumpy manifold. (f) Differential properties derived from our analysis are shown, highlighting the bump maxima corresponding to the most likely generated data points.

[0111] As described above in relation to Figure 7 and discussed below, the inventors have developed a mathematical method to capture the above characteristics through zero-shot analysis of the diffusion model.

[0112] mathematical results Statement 1. Image x0 and the sample extracted according to formula (10).

number

number

number

[0113] This provides a characterization of x0 as a stable maximum point under equation (4) in the backdiffusion process, quantifying both aspects of the gradient magnitude (which should be low) and curvature (which should be high).

[0114] Summary of the proof (the complete proof will be provided later): Firstly, the Gaussian divergence theorem on the curvature term.

number

number

number

number

[0115] System 2. In the setting of Statement 3 below, the following approximation exists.

number

[0116] Proof: Outline (the complete proof will be provided later). By linearity, the expectation value is decomposed into additives via equation (11). That is,

number

number

number

[0117] Statement 3: Given x0, consider equation (10). Here, sample

number

number

number

[0118] This provides a characterization of x0 as a stable maximum point under equation (4) in the backdiffusion process, quantifying both aspects of the gradient magnitude (which should be low) and curvature (which should be high).

[0119] Proof. We begin with the curvature term. By Gauss's divergence theorem,

number

number

number

[0120] Now, we analyze the gradient term.

number

number

[0121] Finally, any linear combination aκ(x0)+bD(x0) can be obtained as follows:

number

[0122] System 4. In the setting of Statement 3, the following approximations may be made.

number

[0123] Proof.

number

number

number

number

number

[0124] Figure 10 shows exemplary method options and analyses for implementing the detection method. In particular, the figure shows (a) our criterion kernel density estimation (KDE) comparing the use of the latent space of a stable diffusion model with CLIP embedding, which shows improved separability; (b) determining the decision threshold using the mean and standard deviation of the real image embedding (while avoiding contamination of the generated data); and (c) the effect of increasing the dimension d on the concentration of ε around the sphere.

number

[0125] Practical options for standards and best practices Given x0, the reference aκ(x0)-D(x0) can be approximated as shown in system 2. For expectation value approximation, we derive s spherical perturbations and sample according to equation (10).

number

number

number

[0126] Here, √(1-α) / α may be omitted. To establish a similarity threshold (which may also be called the "authentic or generated threshold"), the inventors calibrated the model using a set of x0 authentic samples. Observing the histogram of the criterion for this, and noting that it resembles a Gaussian, a threshold of empirical mean + 1 standard deviation was determined, as shown in Figure 10. If C(x0) exceeds this threshold, x0 may be classified as generated; otherwise, it may be classified as authentic.

[0127] From the above mathematical results, we can conclude that:

number

[0128] As described above, the denoising model used by the inventors was a diffusion model. In particular, the inventors implemented their approach within the setting of stable diffusion Rombach et al.

[2022] . The data manifold, score function, despreading, and all related operations are in the latent space

number

number

number

[0129] The inventors mapped latent embeddings to CLIP embeddings (Radford et al.

[2021] ) and observed a substantial improvement in performance. This mapping involves decoding from the latent representation back to image space and encoding using the CLIP image embedder. Of course, other embeddings may be used. Intuitively, the mapping of score functions and signals from latent space to CLIP embeddings leverages the richer semantic understanding provided by CLIP embeddings, as shown in Figure 10.

[0130] Figure 11 shows a visual comparison 1100 between a denoised generated image 1120 and a denoised original image 1110. The denoised image may be output from, for example, the denoising method described in relation to Figure 3 above. The solution developed by the inventors can be based on the inherent differences in the generation and noise patterns of the generated image compared to the original image, and is particularly as follows:

[0131] Consistent Generation Patterns: The first characteristic is that the generated images are the result of noise optimization. That is, it can be assumed that known and yet-to-be-developed image generation methods rely on some kind of noise optimization to generate images. Generated images, especially those created by stable diffusion models, tend to have consistent patterns in their embeddings. When these images are denoised, the underlying generation patterns still exist, which can result in a high degree of similarity between the original embeddings and the denoised embeddings.

[0132] A second characteristic of the generated image is that it is created to best represent the generation prompt. That is, the text-to-image model is developed to generate an image based on the input description. The model is optimized to generate an image that most closely resembles the input description.

[0133] Real images possess natural variability: on the other hand, real images contain natural and diverse noise and texture. When real images are denoised, this natural variability often reduces the similarity between the original embedding and the denoised embedding because the denoising process can alter these natural features.

[0134] Model's Internal Representation: The embeddings (internal representations) captured by the model for the generated images tend to reflect the synthesis process. We have found that the denoising process does not significantly alter these synthesis artifacts, resulting in high similarity. For real images, the denoising process smooths out natural variability, resulting in different internal representations and thus lower similarity.

[0135] Therefore, when comparing an input image to a denoised output image, the similarity between the two embedding vectors is expected to be higher when the input is a generated image than when the input image is a real image, since most / all of the irrelevant "noise" has already been removed in the generation process. As shown in Figure 11, with a real input 1110, the input image and the denoised image may have lower similarity than with a fake computer-generated input 1120. The similarity may be based, for example, on the cosine similarity of the embeddings of the real image and the fake image.

[0136] Figure 12 shows a sample-dependent evaluation 1200 comparing the method disclosed herein with known methods. Without using generated samples, our approach outperforms baseline methods and existing methods in constrained data scenarios. When known methods allow 10 to 50 generated samples, our method performs significantly better than known methods, with an F1 score 0.35 to 0.2 higher. Even when known methods allow 500 to 1000 generated samples, our method remains competitive.

[0137] evaluation The inventors evaluated the advantages of a zero-shot framework, which uniquely avoids reliance on generated image datasets (which can become outdated). In their evaluation, the inventors focused on two aspects.

[0138] 1) Sample Dependency: Evaluating the effectiveness of known methods under the constraints of a limited-size dataset of generated images and simulating the need for rapid adaptation to new techniques. 2) Technique Dependency: Generalization across a variety of previously unseen generative techniques, simulating scenarios including novel out-of-data generations. Therefore, we compared our approach with benchmarks and methods designed for these aspects.

[0139] Experimental setup Datasets. To ensure diverse representations of generative techniques, the methods disclosed herein were evaluated using three benchmark datasets within the domain of generative image detection. The CNNSpot (Non-Patent Literature 2) dataset consists of real and generated images from 20 categories of the LSUN (Non-Patent Literature 5) dataset. The generated images were created by more than 10 generative models, primarily GANs. The Universal Fake Detect (Non-Patent Literature 6) dataset extends CNNSpot with generated images from newer models, primarily diffusion models. The GenImage dataset by Zhu et al.

[2023] is a more recent addition and includes images generated by commercial tools such as Midjourney. In total, the aggregated dataset includes open-source GANs and diffusion models, as well as widely used models such as Stable Diffusion and Dall-E, and over 20 generative techniques from commercial tools, including Karras et al.

[2017] , Zhu et al.

[2017] , Karras et al.

[2019] , Dhariwal and Nichol

[2021] , Ramesh et al.

[2021] , Rombach et al.

[2022] , and Midjourney

[2024] . A complete list of the generative models used in the evaluation is provided below. [Non-Patent Document 5] F. Yu, A. Seff, Y. Zhang, S. Song, T. Funkhouser, and J. Xiao. Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint arXiv:1506.03365, 2015 [Non-Patent Document 6] U. Ojha, Y. Li, and YJ Lee. Towards universal fake image detectors that generalize across generative models. In Proceedings of the IEEE / CVF Conference on Computer Vision and Pattern Recognition, pages 24480‐24489, 2023

[0140] In the evaluation, the inventors extracted a subset from each dataset containing real images and fake images generated from the following generative models: ProGAN Karras et al.

[2017] , StyleGAN Karras et al.

[2019] , BigGAN Brock et al.

[2018] , GauGAN Park et al.

[2019] , CycleGAN Zhu et al.

[2017] , StarGAN Choi et al.

[2018] , Cascaded Refinement Networks (CRN) Chen and Koltun

[2017] , Implicit Maximum Likelihood Estimation (IMLE) Li et al.

[2019] , SAN Dai et al.

[2019] , seeing-dark Chen et al.

[2018] , deepfake Rossler et al.

[2019] , Midjourney Midjourney

[2024] , Stable Diffusion V1.4 Rombach et al.

[2022] , Stable Diffusion V1.5 Rombach et al.

[2022] , ADM Dhariwal and Nichol

[2021] , Wukong MindSpore

[2024] , VQDM Gu et al.

[2022] , LDM Rombach et al.

[2022] and Glide Nichol et al.

[2021] .

[0141] In technology-dependent experiments, the inventors divided the dataset into three groups: images generated by GANs (ProGAN, StyleGAN, BigGAN, GauGAN, CycleGAN, CRN, IMLE, and SAN models), diffusion models (LDM 100, LDM 200, Glide, and Guided diffusion models), and commercially available tools (Midjourney, Stable Diffusion V1.4, Stable Diffusion V1.5, Wukong, VQDM, and DALL-E tools).

[0142] Methods for comparison The inventors benchmarked the method disclosed herein against two major image detection methods, namely Ojha et al.

[2023] and Cozzolino et al.

[2024] (Non-Patent Literature 7). These existing art methods are designed to enhance generalization in detecting images created by unseen generative techniques and are therefore significant for comparison with the inventors' zero-shot approach. For evaluation, the evaluation was extended to additional datasets, strictly following the specifications in each paper of the state-of-the-art methods (the inventors found that the results in the papers were reproducible). [Non-Patent Document 7] D. Cozzolino, G. Poggi, R. Corvi, M. Niessner, and L. Verdoliva. Raising the bar of ai-generated image detection with clip. In Proceedings of the IEEE / CVF Conference on Computer Vision and Pattern Recognition, pages 4356‐4366, 2024

[0143] Comparing zero-shot methods, which do not rely on generated datasets, to supervised methods can introduce intrinsic bias. To address this, the inventors also compared their method to a zero-shot baseline using the same setup. This baseline consists of auto-encoding CLIP embeddings of real images and using the reconstruction error as their generated / real criterion.

[0144] Technical details and baseline implementations of known methods are as follows. As mentioned above, the inventors benchmarked their method against two major image detection methods, namely Ojha et al.

[2023] and Cozzolino et al.

[2024] . These existing techniques are designed to enhance generalization in detecting images created by previously unseen generative techniques and are therefore significant for comparison with the zero-shot approach described herein. Implementations strictly follow the specifications outlined in each publication. In particular, the detection model is trained on images generated by a single model (ProGAN from Karras et al.

[2017] from the CNNSpot dataset in Wang et al.

[2020] ) and tested on images from various other models. To better understand the generalization interaction, the inventors report results for detecting additional generative techniques (extending the results of the original papers). For implementing the method of Ojha et al.

[2023] , the inventors applied a KNN model with k=9 and cosine similarity, as reported, to obtain the best results. For implementing the method of Cozzolino et al.

[2024] , the standard SVM model of Pedregosa et al.

[2011] was used. As described above, comparing zero-shot methods that are independent of the generated dataset with supervised methods can introduce inherent biases. To address this, the inventors also compared their method with a zero-shot baseline using the same setup. This baseline was implemented as an autoencoder that receives only CLIP embeddings of real images. The inventors found that by learning to reconstruct only real embeddings, the autoencoder "fights" with spurious embeddings, resulting in higher reconstruction errors.

[0145] The autoencoder architecture comprises an encoder and a decoder, each having five fully connected layers activated by a ReLU function. The embedding layer size was set to 512. The inventors trained the autoencoder over 500 epochs with a batch size of 62, utilizing a mean square error (MSE) loss function and a learning rate of 0.0001. CLIP embeddings were obtained using the open-source "clip-vit-large-patch14" model. Training was performed using 10 different seeds (1, 5, 9, 16, 17, 24, 43, 54, 59, 65), and the final detection results were averaged to ensure robustness.

[0146] Details of the implementation In an exemplary example of carrying out the inventors' method, the following implementation was used. The denoising model was a diffusion model, specifically the Stable Diffusion 1.4 model. For text captions (given as input in Stable Diffusion 1.4), the inventors used the image-to-text model LLaVA 1.5 from Liu et al.

[2023] . For the reference, three hyperparameters were set: 1) number of spherical noises s = 64, 2) perturbation intensity √(1-α) = 0.8942. This is r B0 Determine the radius of B0 given by 3) Add the (smaller) scalar to the base denominator to ensure it is strictly positive. In this example, δ = 10 -8 .

[0147] Test cases and metrics The evaluation aimed to demonstrate that exemplary implementations of the inventors' methods disclosed herein, using zero-shot image detection, can be effectively generalized to detect images generated by novel, unseen techniques without exposure to or training with any generated images. For the evaluation, the inventors conducted two main experiments regarding sample dependency and technique dependency.

[0148] Sample-dependent experiment. In this evaluation, both the inventors' (zero-shot) method and supervised comparison method were subjected to the same amount of exposure to pre-test data. All methods were exposed to real images, but the supervised method was gradually exposed to a range of 10 to 500 ProGAN-generated images, increasing the number of generated images.

[0149] The total number of training samples was always 1K (e.g., 500 real images paired with 500 generated images). During testing, both our method and the comparative method were evaluated using a balanced test set consisting of 16K images equally divided between real and generated images, encompassing all the generation techniques described above. The F1 score was used as the evaluation metric because it balances the importance of precision and recall by considering both false positives and false negatives. Due to this balance, this score is a suitable metric for evaluating the detector's ability to generalize to new generation techniques.

[0150] Figure 12 shows the sample-dependent evaluation results. The plot shows the average F1 score across different seeds for varying the amount of exposure to generated data in the training set. A key finding from this evaluation was that the state-of-the-art detector requires training across approximately 250 generated samples to achieve performance similar to that of the method disclosed herein. Given the rapid advancements in generation technology, this performance gap is expected to continue to widen.

[0151] Table 1 shows the results for sample-dependent evaluation. In particular, Table 1 shows the F1 scores for different detectors and sample sizes. [Table 1]

[0152] Technology-dependent experiments The second evaluation method is a technique-dependent experiment. This evaluation investigated how the generative techniques used during training affect the detector's ability to generalize to new, unseen techniques. To achieve this, the inventors divided the dataset into three groups: images generated by GANs, diffusion models, and commercially available tools. Each supervised known method was then trained using a balanced training set consisting of 500 real images and 500 images from a specific generative group. As determined from previous experiments, this quantity is sufficient to achieve reasonable performance. Conversely, the inventors' method was exposed to only 1K real images. Performance was tested on the same 16K test set from the previous experiment, using accuracy as the evaluation metric attributable to the balanced set. The results of the second evaluation are shown in Figure 13.

[0153] Figure 13 shows technique-dependent experiments performed by the inventors to evaluate the methods disclosed herein. Plots a.1 to a.3 show the performance of known supervised methods trained on images generated by GANs, commercial tools, and diffusion models, respectively, while plot a.4 shows the performance of the inventors' method.

[0154] Plot b, presented as a polar plot, focuses on the diffusion model and presents a comparison between our method, which is intentionally exposed to such a model, and known methods when trained with diffusion model generation images. In particular, in the diffusion exposure regimes (a.3, a.4, b), our method performed better than known methods in terms of generalizability and accuracy across a diverse set of generation techniques.

[0155] An additional finding from this evaluation was that the generalization ability of the model decreased as the imbalance between generative techniques increased. See, for example, plot a.2, which shows the reduced accuracy on GANs with exposure to commercial tools.

[0156] Tables 2-4 show the results of the technology dependency assessment. [Table 2] [Table 3] [Table 4]

[0157] Further evaluation of the inventors' method was related to its complexity and potential limitations.

[0158] Consideration of complexity Our approach may use inference for multiple spherical perturbations, which can be performed in a single batch using a suitable GPU (we used a single A100 GPU). Known methods appear to share a computational bottleneck, namely the CLIP embedder. Our method may use an additional heavy model (stable diffusion 1.4) and such embedders sequentially, which makes it more computationally intensive.

[0159] Potential limitations The main advantage of our method is its independence from the generated data. However, this method may rely on access to diffusion models, which can introduce a certain level of bias toward detecting images generated by such models, as shown in Figure 13. However, in this case, we have found that our method exhibits generalizability comparable to state-of-the-art supervised methods.

[0160] The inventors also compared the execution time of their method with that of known methods, as shown in Table 5. [Table 5]

[0161] The method described in this specification can use a zero-shot framework for detecting AI-generated images by leveraging the implicit manifold learned by a pre-trained diffusion model. This method combines score function analysis and non-Euclidean manifold geometry to distinguish real images from generated images without requiring additional training on a labeled dataset. This approach addresses the limitations of existing methods that often rely on large datasets of generated images that quickly become obsolete due to the rapid advancement of generation techniques.

[0162] The experimental results disclosed in this specification demonstrate that the implementation of the inventors' method often achieves competitive performance that exceeds the state-of-the-art supervised methods, especially in scenarios where access to generated images is limited. Furthermore, the method disclosed in this specification generalizes well across different generation techniques, highlighting its practical potential in maintaining effective digital authenticity with a high lifespan. [[ID=]5]

[0163] Furthermore, the method described in this specification can facilitate a theoretical understanding of the manifold mismatch between real and generated images.

[0164] The inventors' findings indicate that a pre-trained model and its implicit manifold can be a powerful approach for addressing the challenges presented by AI-generated content, opening the way for a more flexible and adaptable detection framework.

[0165] Figures 14a and 14b illustrate exemplary use cases for the method described in this specification.

[0166] Figure 14a shows a computer-generated image that may be used, for example, on social media and / or by news outlets to spread misinformation. The methods described herein can function as image disinformation detection tools in various domains and may be used to support disinformation prevention efforts.

[0167] Figure 14b shows an example of a computer-generated image that may be used for insurance claims. These generated images could be fraudulently used for insurance claims. Therefore, detecting fake images can be used to prevent fraud. Thus, the method disclosed herein can be used as an image detection tool to distinguish between genuine images of automobile damage and AI-generated images.

[0168] Further implementations of the methods described herein may include fake image detection on social media, news and media verification, fairness in political elections, and legal authentication. Of course, these methods may also be used for other image detection purposes. The detector can function as a reliable disinformation detection tool across various domains, particularly in areas where no existing generated images exist.

[0169] Figure 15 shows an autoencoder model 1500 that can be combined with the detector model described herein. The autoencoder model may perform detection according to the reconstruction error of the autoencoder.

[0170] Input image 1510 can be input into the model. It is unknown whether the input image is real or fake.

[0171] The input image may be received by the CLIP image encoder 1520. The input image may be converted into a CLIP embedding 1525 by the CLIP image encoder. The CLIP embedding may have dimensions 768. Although the inventors used the CLIP image encoder, of course, any suitable image encoder can be used. Of course, the embedding produced by the image encoder may depend on the image encoder used.

[0172] CLIP embeddings can be input to a pre-trained image autoencoder, shown in the figure as the real image autoencoder 1530. The autoencoder may be a type of neural network trained to replicate its input as an output. The autoencoder may be an unsupervised feedforward neural network; that is, the autoencoder may not require labels for training.

[0173] An autoencoder may comprise two fully connected feedforward layers / neural networks. Firstly, an autoencoder may comprise an encoder. The encoder may compress the input embeddings to remove arbitrary forms of noise and generate a latent space / bottleneck. The output dimension of the encoder may be smaller than the input embeddings. For example, the encoder may reduce the embeddings to a 64x64x4 vector. Of course, other embedding sizes may also be used. For example, a 512x1 embedding size may be used in practice.

[0174] An autoencoder may also include a decoder. The decoder can receive a latent vector and attempt to reconstruct the original input data with the highest possible fidelity (thus, the architecture of this neural network is generally a mirror image of the encoder). Thus, the decoder can generate a reconstructed embedding of the input CLIP embedding, shown as CLIP Reconstruction 1540.

[0175] The inventors trained the autoencoder using only real images. Therefore, the autoencoder method for detecting computer-generated images is sometimes called a zero-shot method for detecting computer-generated images.

[0176] The reconstruction error may be determined between the input CLIP embedding and the output CLIP reconstructed embedding, for example, using a loss function. In this example, the inventors used mean squared error (MSE) loss as the loss function. The reconstruction error may be compared to a decision threshold. The decision threshold may be based on the average reconstruction error of the autoencoder training set. That is, an MSE loss may be determined for each training image used to train the autoencoder, and the average of the MSEs for each training image may be used as the decision threshold.

[0177] This method can output a determination of whether an image is real or fake based on a comparison of the reconstruction error with a judgment threshold (1560). For example, if the reconstruction error exceeds the judgment threshold, the image may be considered a fake image. If the reconstruction error falls below the judgment threshold, the image may be considered a real image.

[0178] Since autoencoders can only be trained on real images, if the input image is real, the MSE loss after passing through the autoencoder is expected to be relatively small (e.g., below the judgment threshold). However, if a fake image is input, the fake image may have hidden latent features that are not detected by the human eye but are detected by the autoencoder. Therefore, the MSE error can be large.

[0179] The input image may then be input to a denoising model, and the methods described herein may be performed. The denoising model may be used for verification. For example, if an autoencoder model determines that an image is a computer-generated image, the image may be input to the denoising model. If the denoising model agrees that the image is computer-generated, the final output may be that the image is computer-generated. If the denoising model determines that the image is real, it may override its original determination, and the output may be that the image is real.

[0180] In this example, the setup and configuration of the autoencoder model and the denoising model may be as follows:

[0181] Autoencoder training settings: Batch size - 64; Number of epochs - 500; Optimizer - Adam; Learning rate - 1e-4; Reconstruction error metric - MSE loss. Final characteristics: Autoencoder training final loss -0.00068; decision threshold -0.00016 Characteristics of the denoising model: Image-to-text model - nlpconnect / vit-gpt2-image-captioning. Denoising pipeline: Text tokenizer - CompVis / stable-diffusion-v1-4; Text encoder - CompVis / stable-diffusion-v1-4; UNet model - CompVis / stable-diffusion-v1-4; Image decoder (VAE) - CompVis / stable-diffusion-v1-4; CLIP image encoder - openai / clip-vit-large-patch14; Judgment threshold - 0.7196.

[0182] Figure 16 is a block diagram of an information processing apparatus 1600 or computing device 1600 embodying the present invention, for example, a data storage server, which can be used to implement some or all of the operation of the method embodying the present invention and to perform some or all of the tasks of the apparatus of the embodiment. The computing device 1600 can be used to carry out any of the method steps described above, for example, any of steps S10 to S50. It can be used to provide any or all of the software blocks / modules described herein (for example, the "CLIP image encoder" block or the "image text model" module).

[0183] The computing device 1600 comprises a processor 1603 and memory 1604. Optionally, the computing device also includes a network interface 1607 for communicating with other such computing devices, for example, other computing devices in the embodiments of the invention. Optionally, the computing device also includes one or more input mechanisms, such as a keyboard and a mouse 1606, and one or more display units, such as a monitor 1605. These elements can facilitate user interaction. Each component is connectable to one another via a bus 1602.

[0184] Memory 1604 may include a computer-readable medium, and this term may refer to one or more mediums configured to carry computer-executable instructions (e.g., a centralized or distributed database and / or associated caches and servers). Computer-executable instructions may include instructions and data that are accessible by a computer (e.g., one or more processors) and cause the computer to perform one or more functions or operations. For example, computer-executable instructions may include instructions for implementing a method disclosed herein or any method step disclosed herein, e.g., any of steps S10 to S50. Thus, the term “computer-readable storage medium” may also include any medium capable of storing, encoding, or carrying a set of instructions for machine execution and causing a machine to perform any one or more of the method steps of this disclosure. Thus, the term “computer-readable storage medium” may be interpreted to include, but not limited to, solid-state memory, optical media, and magnetic media. Such computer-readable media may include, but are not limited to, non-temporary computer-readable storage media, including random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), compact disk read-only memory (CD-ROM) or other optical disk storage, magnetic disk storage or other magnetic storage devices, and flash memory devices (e.g., solid-state memory devices).

[0185] The processor 1603 is configured to control a computing device and execute processing operations, which are, for example, for executing computer program code stored in the memory 1604 to perform any of the method steps described herein. The memory 1604 stores data read and written by the processor 1603, and may store at least one noise removal model (such as a pre-trained diffusion model) and / or an image encoder and / or an image texturing model and / or other data as described above, and / or a program for executing any of the above method steps. These entities may be called when needed and may be in the form of code blocks executed by the processor.

[0186] As referred to herein, the processor may include one or more general-purpose processing devices such as a microprocessor, a central processing unit, etc. The processor may include a complex instruction set computing (CISC) microprocessor, a reduced instruction set computing (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or a processor implementing another instruction set or a combination of instruction sets. The processor may also include one or more dedicated processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), a network processor, etc. In one or more embodiments, the processor is configured to execute the operations and instructions for executing the operations described herein. The processor 1603 may be considered to comprise any of the units described above. Any operation described as being performed by a unit may be performed by a computer, for example by the processor 1603, as a method.

[0187] The display unit 1605 may display a representation of data stored and / or generated by the computing device, such as generated images and / or GUI windows and / or determined results of input images (real or computer-generated), and may also display cursors, dialog boxes and screens that enable interaction between the user and programs and data stored on the computing device. The input mechanism 1606 may enable the user to input data and commands, such as input images, into the computing device. For example, the GUI may provide an option to upload an image and may display the determination of a detection model.

[0188] The network interface (network I / F) 1607 may be connected to a network such as the Internet and may be connected to other such computing devices via the network. The network I / F 1607 may control data input / output to / from other devices via the network. Other peripheral devices such as microphones, speakers, printers, power supply units, fans, cases, scanners, and trackballs may be included in the computing device.

[0189] A method of embodying the present invention may be performed on a computing device / apparatus 1600 as shown in Figure 16. Such a computing device does not need to have all the components shown in Figure 16, but may consist of a subset of those components. For example, apparatus 1600 may comprise a processor 1603 and memory 1604 connected to the processor 1603. Alternatively, apparatus 1600 may comprise a processor 1603, memory 1604 connected to the processor 1603, and a display 1605. A method of embodying the present invention may be performed by a single computing device that communicates with one or more data storage servers over a network. The computing device may be data storage itself that stores at least a portion of the data.

[0190] Therefore, in one respect, a computer program is provided that, when executed on a computer, causes the computer to perform a method. The method includes: loading an input image; inputting the input image and a representation describing the input image into a denoising model for denoising the input image using the representation; generating a denoising image embedding from the denoising image; generating an input image embedding from the input image; and determining whether the input image is a real image or a computer-generated image by comparing the difference between the input image embedding and the denoising image embedding with a similarity threshold.

[0191] To carry out the methods described herein, the inventors used the Ubuntu 20.04 Linux® operating system with a standard NC48ads A100 v4 configuration featuring four virtual GPUs and 440GB of memory. The code for carrying out the methods described herein was developed in Python 3.8.2, utilizing the PyTorch 2.1.2 and NumPy 1.26.3 packages for the computational tasks.

[0192] The method of embodying the present invention can be carried out by a plurality of computing devices working together. One or more of these computing devices may be data storage servers that store at least a portion of the data. For example, the diffusion model may be stored in a separate server from the other units.

[0193] The present invention may be implemented in digital electronic circuits, or in computer hardware, firmware, software, or a combination thereof. The present invention may be implemented as a computer program or computer program product, i.e., a computer program tangibly embodied in a non-temporary information carrier, such as a machine-readable storage device, or in a propagating signal, for execution by or control of the operation of one or more hardware modules. The computer program may be stored in a computer-readable medium, which may be non-temporary.

[0194] A computer program may be in the form of a standalone program, a computer program portion, or multiple computer programs, and may be written in any form of programming language, including compiled or interpreted languages, and may be deployed in any form, such as a standalone program or as modules, components, subroutines, or other units suitable for use in a data processing environment. A computer program may be deployed to run on a single module, or on a single site, or on multiple modules distributed across multiple sites and interconnected by a communication network.

[0195] The method steps of the present invention may be performed by one or more programmable processors that execute a computer program to perform the functions of the present invention by acting on input data and generating an output. The apparatus of the present invention may be implemented as programmed hardware or as a dedicated logic circuit, including, for example, an FPGA (Field Programmable Gate Array) or an ASIC (Application-Specific Integrated Circuit).

[0196] Processors suitable for executing computer programs include, for example, both general-purpose and dedicated microprocessors, and any one or more processors in any type of digital computer. Generally, a processor receives instructions and data from read-only memory or random-access memory or both. An essential element of a computer is a processor for executing instructions, coupled with one or more memory devices for storing instructions and data.

[0197] Therefore, from another perspective, an information processing device for detecting computer-generated images is provided, comprising memory and a processor connected to the memory, wherein the processor loads an input image; inputs the input image and a representation describing the input image to a denoising model for denoising the input image using the representation; generates a denoising image embedding from the denoising image; generates an input image embedding from the input image; and compares the difference between the input image embedding and the denoising image embedding with a similarity threshold to determine whether the input image is a real image or a computer-generated image.

[0198] In another aspect, there is a computer program that, when executed by a companion device, causes the companion device to perform a method of a certain embodiment. The computer program may be stored in a computer-readable medium, which may be non-temporary.

[0199] The above-described embodiments of the present invention may be used advantageously independently of other examples / embodiments, or in any feasible combination with one or more of the other embodiments.

[0200] The present invention has been described in relation to specific examples. Other examples are within the scope of the following claims. For example, the steps of the present invention may be performed in a different order and the desired results can still be achieved.

[0201] Those skilled in the art will understand that, except where mutually exclusive, any feature described in any one of the above aspects may be applied mutatis mutandis to any other aspect. Furthermore, except where mutually exclusive, any feature described herein may be applied to any aspect and / or combined with any other feature described herein.

[0202] The following numbered statements provide additional information relating to the present invention. [Statement 1] A computer-implemented method for detecting computer-generated images: The stage of loading the input image; The steps include inputting the aforementioned input image and a representation describing the aforementioned input image into a denoising model for denoising the aforementioned input image using the aforementioned representation; The step of generating a denoised image embedding from the aforementioned denoised image; The step of generating an input image embedding from the aforementioned input image; A step of determining whether the input image is a real image or a computer-generated image by comparing the difference between the input image embedding and the denoising image embedding with a similarity determination threshold. Methods that include... [Statement 2] The method according to Statement 1, wherein the input image is denoised by the denoising model in a single iterative denoising step. [Statement 3] The method according to statement 1 or 2, wherein the expression describing the input image is a text description of the input image. [Statement 4] The method according to Statement 3, wherein the text description is generated by inputting the input image into an image-to-text model. [Statement 5] The method according to any one of statements 1 to 4, wherein the difference includes the cosine similarity between the input image embedding and the denoising image embedding. [Statement 6] The input image embedding and / or the denoising image embedding are generated using an image encoder, according to the method described in any one of statements 1 to 5. [Statement 7] The method according to any one of statements 1 to 6, wherein the similarity determination threshold is set based on the mean and standard deviation of similarity between the original image and the corresponding denoised original image, and the denoised image is denoised by the denoising model. [Statement 8] The noise reduction model is trained using only real images, according to the method described in any one of statements 1 through 7. [Statement 9] The noise reduction model is a diffusion model, as described in any one of statements 1 to 8. [Statement 10] The method according to any one of claims 1 to 9, wherein, upon determining whether the input image is a real image or a computer-generated image, the method further includes the step of outputting whether the input image is a real image or a computer-generated image to an output device, preferably using a graphical user interface. [Statement 11] The computer-generated image is an image generated by an artificial neural network, as described in any one of statements 1 to 10. [Statement 12] Before inputting the aforementioned representation and the input image into the noise reduction model, the method: The step of converting the aforementioned input image into an input image embedding; The steps include: inputting the input image embedding into a pre-trained image autoencoder, wherein the training images of the pre-trained image autoencoder are mainly real images; and generating an autoencoder embedding of the input image embedding as the output of the autoencoder; A preliminary determination is made that the input image is a computer-generated image by comparing the difference between the embedded input image and the embedded autoencoder with an autoencoder determination threshold. The method described in any one of statements 1 through 11, including the method described in any one of statements 1 through 11. [Statement 13] A computer program, when executed on a computer, causes the computer to perform a method, wherein the method is: The stage of loading the input image; The steps include inputting the aforementioned input image and a representation describing the aforementioned input image into a denoising model for denoising the aforementioned input image using the aforementioned representation; The step of generating a denoised image embedding from the aforementioned denoised image; The step of generating an input image embedding from the aforementioned input image; A step of determining whether the input image is a real image or a computer-generated image by comparing the difference between the input image embedding and the denoising image embedding with a similarity determination threshold. including, Computer program. [Statement 14] An information processing device for detecting computer-generated images, comprising a memory and a processor connected to the memory, wherein the processor is: The stage of loading the input image; The steps include inputting the aforementioned input image and a representation describing the aforementioned input image into a denoising model for denoising the aforementioned input image using the aforementioned representation; The step of generating a denoised image embedding from the aforementioned denoised image; The step of generating an input image embedding from the aforementioned input image; A step of determining whether the input image is a real image or a computer-generated image by comparing the difference between the input image embedding and the denoising image embedding with a similarity determination threshold. It is configured to perform Information processing device. [Explanation of symbols]

[0203] 100 1. Obtain a dataset of authentic images 115 2. Obtain the generated image dataset. 120 3. Perform feature extraction 130 4. Train the classifier (Classes: Real, Generative) s10 Load input image s20 The input image and a representation describing the input image are input to a denoising model that uses the representation to denoise the input image. s30 Generate denoised image embedding from denoised image s40 Generate input image embedding from input image s50 The difference between the input image embedding and the denoised image embedding is compared to a similarity threshold to determine whether the input image is a real image or a computer-generated image. 510 Input 520 CLIP Image Encoder 525 Input embedding 530 Image-to-Text Models 540 Noise reduction in a single iterative process 550 Noise-reduced images 560 CLIP Image Encoder 570 Noise reduction embedding 580 Similarity 590 Judgment threshold 595 Fake vs. Authentic 610 "A light gray sofa with a surreal painting in the background" 615 Noise 620 encoded text 630 UNet Model Repeatedly in 635 T iterations 640 Image Decoder 645 generated images 710 "A trio of vibrant pink flowers, each with five petals, set against a green background." 715 inputs 720 encoded text 730 UNet Model 740 Image Decoder 745 Denoised image

Claims

1. A computer-implemented method for detecting computer-generated images: The stage of loading the input image; The steps include inputting the aforementioned input image and a representation describing the input image into a denoising model for denoising the input image using the representation; The step of generating a denoised image embedding from the aforementioned denoised image; The step of generating an input image embedding from the aforementioned input image; A step of determining whether the input image is a real image or a computer-generated image by comparing the difference between the input image embedding and the denoising image embedding with a similarity determination threshold. Methods that include...

2. The method according to claim 1, wherein the input image is denoised by the denoising model in a single-iter denoising step.

3. The method according to claim 1, wherein the representation describing the input image is a text description of the input image.

4. The method according to claim 3, wherein the text description is generated by inputting the input image into an image-to-text model.

5. The method according to any one of claims 1 to 4, wherein the difference includes the cosine similarity between the input image embedding and the denoising image embedding.

6. The method according to claim 1, wherein the input image embedding and / or the denoising image embedding are generated using an image encoder.

7. The method according to claim 1, wherein the similarity determination threshold is set based on the mean and standard deviation of similarity between the original image and the corresponding denoised original image, and the denoised image is denoised by the denoising model.

8. The method according to claim 1, wherein the noise reduction model is trained using only real images.

9. The method according to claim 1, wherein the noise reduction model is a diffusion model.

10. The method according to claim 1, further comprising the step of determining whether the input image is a real image or a computer-generated image, and outputting whether the input image is a real image or a computer-generated image to an output device, preferably using a graphical user interface.

11. The method according to claim 1, wherein the computer-generated image is an image generated by an artificial neural network.

12. Before inputting the aforementioned representation and the input image into the noise reduction model, the method: The step of converting the aforementioned input image into an input image embedding; A step of inputting the aforementioned input image embedding into a pre-trained image autoencoder, wherein the training images of the pre-trained image autoencoder are mainly real images; a step of generating an autoencoder embedding of the aforementioned input image embedding as the output of the autoencoder; A preliminary determination is made that the input image is a computer-generated image by comparing the difference between the embedded input image and the embedded autoencoder with an autoencoder determination threshold. The method according to claim 1, including the method described in claim 1.

13. A computer program, when executed on a computer, causes the computer to perform a method, wherein the method is: The stage of loading the input image; The steps include inputting the aforementioned input image and a representation describing the input image into a denoising model for denoising the input image using the representation; The step of generating a denoised image embedding from the aforementioned denoised image; The step of generating an input image embedding from the aforementioned input image; A step of determining whether the input image is a real image or a computer-generated image by comparing the difference between the input image embedding and the denoising image embedding with a similarity determination threshold. including, Computer program.

14. An information processing device for detecting computer-generated images, comprising a memory and a processor connected to the memory, wherein the processor is: The stage of loading the input image; The steps include inputting the aforementioned input image and a representation describing the input image into a denoising model for denoising the input image using the representation; The step of generating a denoised image embedding from the aforementioned denoised image; The step of generating an input image embedding from the aforementioned input image; A step of determining whether the input image is a real image or a computer-generated image by comparing the difference between the input image embedding and the denoising image embedding with a similarity determination threshold. It is configured to perform Information processing device.

Images