Explaining AI-Image Detection: What the Heatmap Actually Shows

• URL: http://arxiv.org/abs/2607.29581v1
• Date: Fri, 31 Jul 2026 16:07:05 GMT
• Title: Explaining AI-Image Detection: What the Heatmap Actually Shows
• Abstract summary: We build a detector and attach an attribution map as its evidence.<n>We measure what that pair delivers on 186,527 images under controls.<n>Whether an attribution ranking exists at all depends on whether the detector reacts to the image.
• Score: 65.01025489527173
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: A marketplace review photograph is a document: platforms approve refunds on it, and generative models drove the cost of forging one to zero. We study that detection problem, so we build a detector and attach an attribution map as its evidence, then measure what that pair delivers on 186,527 images under controls designed to change our conclusions when something is wrong. Compression history, not synthesis, drives naive evaluation: our strongest model reaches 0.9999 PR-AUC (area under the precision-recall curve) on a product-disjoint split, yet falls to 0.7254 once we re-encode synthetics into the real class's format, while five public detectors move by at most 0.07. Aligning one class relocates the cue rather than removing it, and the repaired model then assigns native files a median probability of synthesis of 0.0004. One identical final encode for both classes repairs that, and a three-seed factorial credits the encoding change with the whole gain (+0.176 +- 0.009 PR-AUC). That encode equalises the last stage only: forensic features alone still separate the classes at 0.7145 against a base rate of 0.254. For evidence we test maps causally, against controls that never consult the detector. Whether an attribution ranking exists at all depends on whether the detector reacts to the image. On our first-fix detector, which calls 96 of 100 edited frames real, no map beats a random one. On the detector we selected, twelve of seventeen maps clear that control on edited images and eight on generated ones; perturbation leads both axes and no gradient-CAM variant shows a positive advantage. The trivial controls never clear it, and on generated images the centre prior is worse than random. Our ensembled regional map clears both axes and takes the top pixel AP at 12.4 s per map against 44.9 for occlusion. Clearing a detector-blind control is not yet a faithful explanation, and we demonstrate none.

Related papers

• Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery [0.0]
  We reproduce the Reprompt forgery attack of Mller et al. against Tree-Ring on Stable Diffusion XL.<n>We detect genuine images 6/6, clean images 0/6, and forged images 5/6, at 325-332 s per attack.
  arXiv  Detail & Related papers  (2026-09-11T14:35:42Z)
• Self-Calibrating Dense Displacement Fields for Reliable Co-Registration of Large Optical Satellite Imagery [4.730120849611304]
  Co-registration underlies nearly every multi-temporal and multi-sensor use of optical satellite imagery.<n>We present SCDF, a training-free, GPU-free estimator whose motion model is the dense per-pixel displacement field itself.<n>On 584 constructed-ground-truth pairs built from real Sentinel Landsat-8/9, and NAIP imagery, SCDF registers every pair with zero failures.
  arXiv  Detail & Related papers  (2026-08-23T08:50:59Z)
• MIRROR: Multimodal Intelligent Radiology Reasoning and Observation Reporter [1.3106404792425626]
  MIRROR is a research prototype built to separate failures from successes.<n>It chains a multi-label classifier, a Grad-CAM localizer, and a report writer that receives the labels, probabilities, and regions but never the image.<n>A MIRROR report's findings are auditable against the probability vector, while the sentences framing them are ordinary generated text.
  arXiv  Detail & Related papers  (2026-08-17T15:25:38Z)
• Tactus: Open-Vocabulary Object Recognition from Low-Cost Pressure Arrays [0.0]
  We present Tactus, an open model that answers text queries from pressure data alone.<n>The recipe is small-data: 187 training recordings, masked-autoencoder pretraining on 144k unlabeled same-sensor frames, and the sensor's own calibration affine.<n>Weights, code, and the memory layer the model plugs into are released openly.
  arXiv  Detail & Related papers  (2026-08-04T06:08:21Z)
• Visual Credit Audit for Multimodal Spatial Reasoning [70.16915309526443]
  Visual Credit Audit separates two Estimands: whether the benchmark image gives the model's declared decision more support than text-only and blank controls, and whether the model responds to relation-specific visual evidence.<n>Applying labels yields dependence-credited correctness (D-CC)<n>Across four open MLLMs and two spatial benchmarks, 12.73-26.25% of decisions are correct yet uncredited.
  arXiv  Detail & Related papers  (2026-07-29T15:55:31Z)
• Adversarial Test-Hardening for AI-Written Code: An Instrument Autopsy and a Pre-Registered Causal Estimate of the Critic Loop [0.0]
  We study an adversarial test-hardening loop under a mechanical oracle.<n>A Tester model writes tests, mutation testing names surviving injected defects, and a Critic model writes tests to kill exactly those.<n>We release both protocols, all receipts, and the analysis code.
  arXiv  Detail & Related papers  (2026-07-25T02:38:07Z)
• A New Kind of Adversarial Example: Measuring the Human-Model Gap, and Its Relationship to OOD Detection [18.313155919803034]
  A large, clearly visible perturbation causes the model to keep its original, correct prediction, even though a human would no longer recognize the image.<n>We answer whether humans really perform worse than the model, whether standard out-of-distribution (OOD) detection and calibration tools catch it, and whether existing defenses mitigate it.
  arXiv  Detail & Related papers  (2026-07-22T00:44:06Z)
• A global predicted-fMRI drive signal from TRIBE does not predict YouTube replay heatmaps [0.0]
  multimodal brain-encoding models predict fMRI responses to naturalistic video with high accuracy.<n>We run TRIBE on 48 YouTube videos and reduce its predicted cortical response to a per-second engagement curve.<n>Running the probe on TRIBE's input streams reveals at most a small, borderline visual-stream signal.<n>We release code, a video-ID manifest, and a heatmap-acquisition method robust to YouTube's SABR streaming.
  arXiv  Detail & Related papers  (2026-07-01T19:03:17Z)
• Confidently Wrong: Severity-Aware Calibration of Prompt-Injection Detectors under Attack Shift [0.0]
  I evaluate three released detectors, ProtectAI-v2 and two Prompt-Guard-2 checkpoints, at a single source-calibrated threshold.<n>I report a severity metric S, how confident a detector is on the attacks it misses, alongside the false-negative rate and discrimination.<n>All three confidently pass indirect behavior-hijack injection, a blind spot unanimous across two vendors and a fourfold size range.
  arXiv  Detail & Related papers  (2026-06-21T20:30:12Z)
• KoALA: KL-L0 Adversarial Detector via Label Agreement [9.360893727306324]
  KoALA is a semantics-free adversarial detector for deep neural networks.<n>It detects adversarial attacks when class predictions from two complementary similarity metrics disagree.<n>KoALA achieves a precision of 0.94 and a recall of 0.81 on ResNet/CIFAR-10, and a precision of 0.66 and a recall of 0.85 on CLIP/Tiny-ImageNet.
  arXiv  Detail & Related papers  (2025-10-14T17:33:00Z)
• An Undetectable Watermark for Generative Image Models [65.31658824274894]
  We present the first undetectable watermarking scheme for generative image models.<n>In particular, an undetectable watermark does not degrade image quality under any efficiently computable metric.<n>Our scheme works by selecting the initial latents of a diffusion model using a pseudorandom error-correcting code.
  arXiv  Detail & Related papers  (2024-10-09T18:33:06Z)
• Zero-Shot Detection of AI-Generated Images [54.01282123570917]
  We propose a zero-shot entropy-based detector (ZED) to detect AI-generated images. Inspired by recent works on machine-generated text detection, our idea is to measure how surprising the image under analysis is compared to a model of real images. ZED achieves an average improvement of more than 3% over the SoTA in terms of accuracy.
  arXiv  Detail & Related papers  (2024-09-24T08:46:13Z)
• DetCo: Unsupervised Contrastive Learning for Object Detection [64.22416613061888]
  Unsupervised contrastive learning achieves great success in learning image representations with CNN. We present a novel contrastive learning approach, named DetCo, which fully explores the contrasts between global image and local image patches. DetCo consistently outperforms supervised method by 1.6/1.2/1.0 AP on Mask RCNN-C4/FPN/RetinaNet with 1x schedule.
  arXiv  Detail & Related papers  (2021-02-09T12:47:20Z)
• Empirical Upper Bound, Error Diagnosis and Invariance Analysis of Modern Object Detectors [47.64219291655723]
  We employ 2 state-of-the-art object detection benchmarks, and analyze more than 15 models over 4 large scale datasets. We find that models generate a lot of boxes on empty regions and that context is more important for detecting small objects than larger ones.
  arXiv  Detail & Related papers  (2020-04-05T06:19:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.