Can an AI generated image (such as pic of human face) be detected that it's AI generated?

Question

AIs are getting better and better at creating images and art. Some of the stuff is almost impossible to be detected by the naked eye. But what about programs and algorithms? Instead of creating an image, can anything detect that this image was created by an AI?

Take this one for example:

This picture of a woman's face was generated by AI

Answer 1

Images such as this one are produced using generative adversial network, which is build from two models:

• one to generate images given a random vector as input
• another trying to detect the generated image from two images, with one of them being real

Then the weights of the first model are updated if the second one detected which image is artificial, and the second model is updated if its prediction is wrong.

Of course you might build a model that can sometime detect AI generated images, but it is probably not possible to differentiate them all the time. Then, if you build such model that is better than any other model to detect generated images, it is possible to create another model trained to fool it.

Answer 2

I am not an expert, but it feels like these GANs are not paying attention to the clothes and the background and make them "fluid".

Like, what is this hat the woman in your example is wearing? Why is the right side of the background looks like it is a mix of liquid paint?

Or here: What is she wearing? Did she kill a rat to make these clothes? And similar fluid background.

Answer 3

TL;DR: Yes, but it's becoming more and more difficult, even for humans, as generative models get better and better. It's a quite hot research topic.

Disclaimer: I am not affiliated with any of the authors, I'm just studying this research topic.

Humans usually look for some visual artifacts (as all the other answers point out), for example

• Colour or texture artifacts (colour blobs, unrealistic texture)
• Asymmetries or inconsistencies in the image (this is easy to spot in faces or hair, for example)
• Anomalies in color, lighting, image parts

But as models become more and more advanced, these artifacts are becoming harder to spot, if not completely disappeared. As in 2023, images coming from diffusion models like Stable Diffusion or Midjourney API have a photorealistic quality, and often are already indistinguishable from real images (see some examples here).

For these reasons, we want to find automatic and more robust detection approaches to prevent malicious uses of these AI generation models.

Detection approach

A simple approach is to train a detector on AI generated images, which classifies the image as real or AI generated either by looking at the whole images or at single patches [Chai et al., 2020].

A more performing approach is to exploit some invisible artifacts created by the convolutional upsampling, which is commonly used in GANs and in some Diffusion models (Stable Diffusion, for example) to create high-resolution images. While invisible in the image domain, this trace can be easily extracted and identified in the frequency domain [Marra et al., 2019, Yu et al., 2019].

The detector needs to be robust to common image modifications (contrast/luminosity, colour jittering, jpeg compression,etc.) and also to adversarial attacks on the detector.

Watermarking/Fingerprinting

To proactively improve the detection performance, the developers of generative models could include a watermark in their images, to mark the images produced by their models as AI-generated. This watermark is typically invisible, and can be generated in several ways:

• Traditional approaches are based on frequency decompositions of the image, constructed through DCT, DWT, Fourier-Mellin, or complex wavelet transformations Cox et al., 1996, O’ Ruanaidh et al., 1996, O’Ruanaidh and Pun, 1997]. These frequency transformations all share the beneficial property that simple image manipulations, such as translations, rotations, and resizing are easily understandable and watermarks can be constructed with robustness to these transformations in mind.
• Model-based approaches use a different learned model to embed a watermark in the image. Hayes and Danezis [2017] and Zhu et al. [2018] propose strategies to learn watermarking end-to-end, where both the watermark encoder and the watermark decoder are learned models, optimized via adversarial objectives to maximize transmission and robustness [Zhang et al., 2019]. Zeng et al. [2023] present a related approach, in which a neural network watermarked encoder and its associate detector are jointly learned using an image dataset. Notably these approaches still work like a traditional watermark in that the encoder imprints a post-hoc signal onto a given image - however the type of imprint is now learned.
• More recent approaches use another model or the generative model itself to either embed the watermark after the generation process or during the generation process. Some approaches consist in embedding a watermark in training data [Yu et al., 2022], in some components of the model (e.g the convolutional decoder) [Fernandez et al., 2023], or by slightly modifying the distribution from where sampling is performed [Wen et al., 2023].

As detectors, watermarks need to be robust to common image transformations (such as cropping, contrast/luminance editing, jpeg compression, etc.) and adversarial attacks that actively try to remove the watermark.

References

• Gragnaniello, Diego et al. “Are GAN Generated Images Easy to Detect? A Critical Analysis of the State-Of-The-Art.” 2021 IEEE International Conference on Multimedia and Expo (ICME) (2021): 1-6.
• enbo Wan, Jun Wang, Yunming Zhang, Jing Li, Hui Yu, and Jiande Sun. A comprehensive survey on robust image watermarking. Neurocomputing, 488:226–247, June 2022. ISSN 0925-2312. doi: 10. 1016/j.neucom.2022.02.083. URL https://www.sciencedirect.com/science/article/ pii/S0925231222002533.
• [Cox et al., 1996] Cox, I., Kilian, J., Leighton, T., and Shamoon, T. (1996). Secure spread spectrum watermarking for images, audio and video. In Proceedings of 3rd IEEE International Conference on Image Processing, volume 3, pages 243–246 vol.3.
• [O’ Ruanaidh et al., 1996] O’ Ruanaidh, J., Dowling, W., and Boland, F. (1996). Watermarking digital images for copyright protection. IEE PROCEEDINGS VISION IMAGE AND SIGNAL PROCESSING, 143:250–256.
• O’Ruanaidh and Pun, 1997] O’Ruanaidh, J. J. and Pun, T. (1997). Rotation, scale and translation invariant digital image watermarking. In Proceedings of International Conference on Image Processing, volume 1, pages 536–539. IEEE.
• [Zhu et al., 2018] Zhu, J., Kaplan, R., Johnson, J., and Fei-Fei, L. (2018). Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pages 657–672. 3
• [Marra et al., 2019] Marra, F., Gragnaniello, D., Verdoliva, L., and Poggi, G. (2019). Do gans leave artificial fingerprints? In 2019 IEEE conference on multimedia information processing and retrieval (MIPR), pages 506–511. IEEE.
• [Yu et al., 2019] Yu, N., Davis, L. S., and Fritz, M. (2019). Attributing fake images to gans: Learning and analyzing gan fingerprints. In Proceedings of the IEEE/CVF international conference on computer vision, pages 7556–7566. 2
• [Chai et al., 2020] Chai, L., Bau, D., Lim, S.-N., and Isola, P. (2020). What makes fake images detectable? understanding properties that generalize
• [Yu et al., 2022] Yu, N., Skripniuk, V., Abdelnabi, S., and Fritz, M. (2022). Artificial fingerprinting for generative models: Rooting deepfake attribution in training data.
• [Corvi et al., 2023] Corvi, R., Cozzolino, D., Zingarini, G., Poggi, G., Nagano, K., and Verdoliva, L. (2023). On the detection of synthetic images generated by diffusion models. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1–5. IEEE.
• [Wen et al., 2023] Wen, Y., Kirchenbauer, J., Geiping, J., and Goldstein, T. (2023). Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust.
• [Fernandez et al., 2023] Fernandez, P., Couairon, G., J ́egou, H., Douze, M., and Furon, T. (2023). The stable signature: Rooting watermarks in latent diffusion models.

Answer 4

I have not worked practically with GANs and just know their theory, but I do not agree 100% with this comment that AI chooses stupid things for clothes or backgrounds. I remember it could be detected when a video was generated with deep learning methods from Obama.

Answer 5

There's a paper that claims to detect AI generated images with a 95% accuracy. https://www.researchgate.net/publication/326053461_Detection_of_GAN-Generated_Fake_Images_over_Social_Networks

A search with the right keywords can reveal more such research.