Diffusion models and inversion mechanisms

The evolution of generative visual models has witnessed diffusion models establish dominance through theoretical innovation and engineering breakthroughs. While pioneering Generative Adversarial Networks (GANs) [8] achieved breakthroughs in image quality, their inherent training instability and mode collapse limitations motivated the exploration of alternative paradigms. The seminal work by Ho et al. [25] on Denoising Diffusion Probabilistic Models (DDPMs) marked a technological inflection point, delivering high-fidelity image synthesis with unprecedented training stability.

Subsequent research has turned attention to diffusion models to refine architecture [1,26], accelerate sampling [27,28], and explore downstream tasks [29,30]. Song et al. [31] pioneered Denoising Diffusion Implicit Models (DDIMs), introducing non-Markovian sampling processes that simultaneously enhance sampling speed and output quality. Dhariwal et al. [1] systematically optimized model architectures with extensive experiments, achieving superior performance via classifier-guided sampling. Rombach et al. [26] later proposed Latent Diffusion Models (LDMs), a pivotal development that maintains image quality while substantially reducing computational requirements.

Recent advancements in diffusion models extend to conditional generative models, particularly text-to-image synthesis. Models like DALL-E [3,4] and Imagen [32] leverage the inherent stability of diffusion processes to align visual outputs with textual descriptions via progressive denoising.

Now, the diffusion model has formed a complete technical system encompassing basic theories [25,31], computational optimizations [1,26–28], and multimodal applications [3,4,32]. Compared to GANs [8–12], diffusion models exhibit significant advantages in terms of training stability and generative controllability. More importantly, their iterative noise-adding and denoising structure naturally supports inversion and reconstruction processes, enabling input images to be mapped into a latent noise space and reconstructed. Although these inversion mechanisms were initially primarily used for image editing and generative control, recent research shows that they have become essential tools for analyzing and detecting diffusion-generated images.

Detection of diffusion-generated images

The fundamental challenge in AI-generated image detection lies in distinguishing whether an image is sourced from the physical world or algorithmically synthesized content. Early methods primarily targeted GAN-generated images, relying on frequency domain artifacts [13–16] or local texture inconsistencies [17–19]. However, the rapid proliferation of diffusion models has significantly diminished the effectiveness of these GAN-specific detectors.

For diffusion-generated images, recent research has progressively introduced multimodal semantic understanding and feature fusion strategies. Approaches such as CLIP-driven feature alignment [20,21], multi-stream fusion architectures [22,23], and the construction of adversarial training sets with reverse image search [24] have enabled precise identification of cross-modal semantic contradictions. Meanwhile, dynamic texture features integrated with semantic contexts [33] and multi-scale semantic pyramids architectures [34] have further enhanced the ability to detect subtle forgery traces.

Additionally, reconstruction-based detection has emerged as a dedicated approach specifically designed for diffusion models. DIRE [35] pioneered the use of pixel-level reconstruction errors from diffusion inversion to reveal the instability of generated images. DNF [36] and LaRE² [37] improved detection efficiency and performance by leveraging inverse diffusion noise statistics and latent space reconstruction errors, respectively. FakeInversion [24] demonstrated that inversion instability is more pronounced for images generated by unseen text-to-image models. FIRE [38] further enhanced detection discriminability by analyzing reconstruction errors through frequency decomposition. Although existing methods have validated the effectiveness of reconstruction discrepancies, most treat reconstruction errors as static features and have yet to systematically analyze reconstruction stability under controlled input variations.

Stability and sensitivity of diffusion reconstructions

The stability issues in the inversion and reconstruction processes of diffusion models have garnered increasing attention in recent years. Unlike traditional discriminative models, the reverse diffusion process typically involves multi-step numerical approximations, rendering its trajectory potentially sensitive to initial conditions and data distributions. Liu et al. [28] provided foundational theoretical analysis by examining the numerical properties of diffusion models on data manifolds, revealing that the reverse diffusion process is notably sensitive to initial perturbations and approximation errors.

At the application level, inconsistent behaviors induced by input distribution discrepancies have been observed in diffusion inversion and image editing tasks. Parmar et al. [29] discovered significant variations in how different input images respond to editing operations after diffusion inversion, indicating high sensitivity to distribution shifts. Furthermore, Salman et al. [39] demonstrated that even minor input perturbations can be progressively amplified during diffusion generation and editing, substantially affecting final outcomes.

Related research indirectly corroborates this phenomenon from perspectives of data protection and generative control. Multiple studies have shown that introducing structured perturbations or protective noise at the input stage can significantly alter inversion trajectories and generation results, confirming that diffusion models lack robustness in reconstruction consistency when facing input variations [40–43].

In summary, existing work has revealed the sensitivity of diffusion model inversion to input variations and distribution shifts through theoretical analysis and perturbation experiments. However, this stability discrepancy has yet to be systematically modeled as a discriminative signal for detecting generated images.

Proposed method

In this section, we describe the proposed ADRD framework. Our method is based on the modeling assumption that real images and diffusion-generated images exhibit systematically different reconstruction behaviors under the same diffusion reconstruction operator. The diffusion reconstruction process can be viewed as an approximate projection onto the image manifold implicitly learned by the diffusion model. While diffusion-generated images naturally conform to this manifold, real images may deviate from it due to restricted model capacity and distribution shifts.

To expose this difference, we introduce a controlled perturbation in the latent space as a probe, which is applied uniformly to both real and diffusion-generated images. The probing perturbation is not intended to alter image semantics, but to amplify the intrinsic discrepancy in reconstruction stability between the two image sources. We then quantify this discrepancy by measuring the difference between the original images with probe and their reconstructed counterparts with probe, forming the ADRD, which serves as the detection criterion.

Problem formulation

Given a diffusion model parameterized by θ, its reconstruction process can be formulated as the reconstruction operator . Here, denotes the input image, represents the forward noising process, and is the reverse denoising process. This operator can be viewed as an approximate projection that maps input samples onto the image manifold implicitly learned by the diffusion model. Since diffusion-generated images inherently conform to this manifold structure while real images typically reside outside or near its boundary, the two categories exhibit systematic differences in diffusion reconstruction stability.

To amplify this divergence, we introduce an active probing perturbation in the latent space and uniformly apply it to the latent representations of real images and diffusion-generated images as shown in Fig 2. Based on the diffusion reconstruction results, we define their respective reconstruction errors as:

Download:

• PNG
  larger image
• TIFF
  original image

Fig 2. Detection process for diffusion-generated images.

https://doi.org/10.1371/journal.pone.0350655.g002

The objective of this work is to learn an optimal latent space probing perturbation that maximizes the difference in reconstruction errors between real and diffusion-generated images under identical perturbation conditions:

where constrains the perturbation magnitude to avoid introducing perceptible changes.

An active probing perturbation δ is superimposed onto the original image. A Latent Diffusion Model (LDM) is then employed as a pre-trained diffusion model to reconstruct the original image in latent space. The reconstruction error is computed as the difference between original image and its reconstruction. The optimized perturbation δ is obtained through iterative optimization algorithms, with the objective of maximizing the difference in reconstruction errors between real and diffusion-generated images.

It should be noted that the reconstruction operator involved in the optimization objective above is inherently a stochastic process. Due to the random noise introduced during the forward noising and reverse denoising processes, the output of diffusion reconstruction varies across different noise realizations. Consequently, the reconstruction errors and can be regarded as random variables due to stochastic diffusion trajectories. The difference term corresponds to an estimation of the expected reconstruction error under the distribution of stochastic diffusion trajectories. This stochasticity makes it challenging to obtain the gradient of the objective function with respect to the probing perturbation in an analytical form.

Therefore, this work adopts a Monte Carlo strategy to approximate the gradient estimation. By sampling N independent diffusion trajectories, the gradient is estimated as:

where represents the latent variable representations during the denoising process, and denotes the distribution of .

This approach renders the optimization problem practically solvable, ensuring computational feasibility while providing stable gradient estimates for subsequent perturbation optimization.

After approximating the gradient of the reconstruction error difference, this work employs a constrained iterative optimization strategy to update the latent space probing perturbation . Specifically, we utilize projected gradient ascent method, where at each iteration the perturbation is updated along the direction that amplifies the reconstruction difference between real and diffusion-generated images. This update strategy draws inspiration from the FGSM [44] but is adapted to the maximization objective of this work. The iterative update rule is expressed as:

where is the step size parameter, is the sign function (providing stable gradient direction), and denotes the projection operator that constrains the perturbation within an -norm ball of radius .

This iterative optimization is performed in latent space, ensuring relatively stable convergence behavior even in the presence of noisy stochastic gradient estimates. Through multiple iterative updates, an optimal latent-space probing perturbation that maximizes the reconstruction error difference under constraints is progressively obtained. This serves as a critical discriminative signal for subsequent reconstruction-difference-based detection methods.

This process is summarized in Algorithm 1. By sampling different Gaussian noises in latent space and performing gradient ascent on the computed image reconstruction error across multiple samples, the maximized image difference value is achieved.

Algorithm 1. Probing perturbation optimization

Input: Real image , Diffusion-generated image , Diffusion model parameters ,

Number of Monte Carlo , Step Length , Perturbation budget , Number of iterations T

Output: Optimized probing perturbation δ*

Initialize ← 0

for t = 0 to T – 1 do

   grad ← 0

   for i = 1 to N do

      ,

   end for

end for

return

Universal latent-space probing perturbation

In Section 3.1, we discussed a method for learning latent-space probing perturbation tailored to a single pair of real and diffusion-generated images. However, in practical diffusion-generated image recognition scenarios, we do not have prior knowledge of which diffusion model was used to generate a given image. Therefore, probing perturbation learned for a single image pair or a specific generative model may lack generalization capability in real-world applications.

To address this, we propose a strategy for learning a universal latent-space probing perturbation. The core idea is to jointly model the reconstruction difference behavior across multiple pairs of real and diffusion-generated images during perturbation optimization, directly learning a unified perturbation that remains effective under diverse samples and multiple models.

Specifically, let denote a collection of image pairs comprising real images and images generated by different diffusion models. We introduce a shared probing perturbation in latent space and apply it simultaneously to the latent representations of all samples. Based on the diffusion reconstruction results, we define the difference in reconstruction errors between real and generated images and optimize the expected value of this difference over the sample set.

As illustrated in Fig 3, this universal probing perturbation can be interpreted as seeking a direction in latent space where the reconstruction response of diffusion-generated images remains relatively stable, while the reconstruction deviation of real images is significantly amplified.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 3. Schematic diagram for calculating the universal probing perturbation.

https://doi.org/10.1371/journal.pone.0350655.g003

Color-coded regions represent the latent-space distributional differences between real images and different diffusion-generated images after diffusion reconstruction. Given multiple pairs of real and diffusion-generated images, a shared probing perturbation is introduced in latent space and uniformly applied to all sample images. Through joint optimization, probing perturbation systematically amplifies the differences between real and generated images during diffusion reconstruction. The dashed arrows indicate the optimized probe direction (maximizing the difference) within the latent-space distributional differences of different diffusion-generated and real image pairs.

In practical optimization process, we directly adopt the Monte Carlo gradient estimation and projected gradient ascent strategy described in Algorithm 1. The key adaptation is that during each gradient update, we average the reconstruction error gradients across multiple sample pairs to jointly optimize every shared probing perturbation.

Diffusion reconstruction and difference metric

We observe that the reconstruction operator of diffusion models exhibits distinct stability characteristics for real versus diffusion-generated images. Specifically, real images show significantly greater displacement from their original inputs after reconstruction compared to diffusion-generated images. To actively amplify this discrepancy, we introduce a probing perturbation in latent space. As demonstrated in Fig 4, measurable differences emerge in the error between reconstructed images and originals. Diffusion-generated images exhibit a higher proportion of black pixels upon reconstruction, suggesting smaller pixel-space differences compared to real images.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 4. Comparison of ADRD differences between real and diffusion-generated images.

(A) Difference after real image reconstruction. (B) Difference after generated image reconstruction.

https://doi.org/10.1371/journal.pone.0350655.g004

Convert reconstructed images to pixel space and compute the absolute difference (magnified 5×). Observations reveal that diffusion-generated images (right) exhibit a higher proportion of black pixels compared to real images (left) under identical probing perturbation. This visually evident contrast indicates distinct stability behavior of the diffusion reconstruction operator for genuine versus generated inputs.

The specific method is as follows: Given an input image , we first map it to latent space via a VAE module and apply the learned universal probe , yielding the perturbed representation . We then execute a full diffusion reconstruction process with pretrained LDM without any fine-tuning. As illustrated in Fig 2, The diffusion process progressively corrupts through -step Gaussian noise injection, ultimately yielding isotropic Gaussian-distributed noise image . Subsequent reconstruction via the denoising process recovers the image as . By comparing the differences between and , real images and diffusion-generated images can be effectively distinguished.

Thus, we present the definition of ADRD:

Where represents the sampling process in diffusion reconstruction, and represents the denoising process in diffusion reconstruction. This metric stably captures differences in geometric relationships between input images and the diffusion model manifold.

Neural network classifier

After completing diffusion reconstruction and computing the differences between input images and their reconstructed outputs, we treat the resulting difference tensor as a structured response map that characterizes reconstruction stability relative to the diffusion model manifold. To transform this difference map into a discriminative decision signal, we introduce a lightweight convolutional neural network as a binary classifier to distinguish real images from diffusion-generated ones.

The classifier employs a multi-layer convolutional architecture to hierarchically extract local and global statistical features from the difference tensor. It is trained with a simple binary cross-entropy loss:

where N is the batch size, denotes ground truth labels, and represents the classifier’s predictions.

Critically, this classifier serves solely as a discriminator for difference representations. Its purpose is to evaluate the separability of features derived from ADRD, not to rely on complex model architectures for detection.

Experiments

This section presents the experimental configuration and evaluation protocol used to assess the proposed detection method. We conduct a series of experiments across multiple benchmark datasets and generation settings to examine the effectiveness, generalization, and robustness of the approach under consistent training and testing conditions.

Experimental configuration

Implementation details

All input images are uniformly resized to 512 × 512 pixels and normalized to the [0, 1] range. Images are then encoded into latent space with pretrained VAE. A probing perturbation is added on images in latent space, followed by diffusion reconstruction. The pre-/post-reconstruction error is used to construct detection features, which are subsequently fed into a classifier.

Reconstruction configuration

We use Stable Diffusion v1.5, implemented under the Latent Diffusion Model (LDM) framework, with publicly available pretrained weights [26]. The diffusion model parameters are kept frozen, without any fine-tuning or retraining during all experiments.

In diffusion reconstruction stage, we employ the DDIM sampler with 25 denoising steps, 0.6 reconstruction strength, and a linear noise schedule. Real and diffusion-generated images are reconstructed with identical settings. We adopt unconditional reconstruction (empty prompt) and set the guidance scale to 1.0 to avoid introducing additional semantic priors from text conditioning.

Probing perturbation

Probing perturbation is optimized in latent space, parameterized as directional vectors with an explicit -norm constraint (). Optimization is performed using Adam with a learning rate of 0.15 for 30 iterations.

In each iteration, the same probe is applied simultaneously to latent representations of both real and diffusion-generated images, and the reconstruction responses are computed. To obtain backpropagation gradients through the diffusion model, the reconstruction response is estimated via Monte Carlo sampling, with 8 samples per estimate. Real and diffusion-generated images share identical parameter configurations during perturbation addition, diffusion reconstruction, and discrepancy computation. 8 real–generated image pairs are randomly selected per class for perturbation learning, with a batch size of 16.

Classifier

The reconstruction difference tensor is fed into a CNN-based binary classifier in experiments. The network input is a 4 × 64 × 64 latent tensor. Discriminative features are extracted through 4 cascaded convolutional modules, followed by adaptive global average pooling and a fully connected layer to output the binary prediction. The classifier architecture is kept identical across all experiments, and it is used solely to evaluate detection performance under different diffusion reconstruction difference settings.

Hardware

All experiments are conducted with NVIDIA TITAN RTX (24GB VRAM). The deep learning framework is PyTorch 2.5.1 + cu120, and diffusion inference pipeline is implemented with the official Diffusers library. Random seeds are fixed at key steps to ensure reproducibility of the results.

Generalization evaluation

Single-generator training evaluation.

We first evaluate the cross-generator generalization ability of our model on GenImage. Specifically, the model is trained on images from one diffusion generator, and tested on images from the remaining generators. Each experiment is repeated with 5 random seeds, and the results are averaged. The overall results are shown in Fig 5.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 5. Comparison of classification performance across different datasets and diffusion generators.

From left to right, the figure reports ACC, AP and AUC. The top row shows the cross-validation results on GenImage, while the bottom row shows the results on WildFake. Each subplot presents detection performance under different diffusion generators, where the x-axis denotes the test subsets (corresponding to different diffusion generators) and the y-axis indicates the source generator used for training.

https://doi.org/10.1371/journal.pone.0350655.g005

1. (1) Detecting images generated by seen generators is relatively easy. When the train and test sets come from the same generator, our method exhibits stable performance across all evaluation metrics. This indicates that the proposed detection framework can effectively capture reconstruction difference between real and diffusion-generated images under specific generator.
2. (2) Generalization varies substantially depending on the generator used for training. Among all training sources, the model trained on Imagen-generated images from WildFake demonstrates the strongest generalization ability, achieving relatively consistent detection performance across multiple unseen generators. Specifically, it reaches ACC/AP/AUC of 82.1 ± 2.2%, 87.7 ± 2.4%, and 88.1 ± 2.2, respectively.
3. (3) Overall performance is better when testing on WildFake dataset. This is mainly attributable to distributional differences between the 2 datasets. Images in WildFake are relatively constrained in terms of semantic consistency, and the distribution gap between real and diffusion-generated images is more pronounced. As a result, the detection task becomes inherently easier, leading to a relatively better overall performance.

Leave-one-model-out evaluation.

To evaluate whether ADRD can transfer to unseen generators, we adopt a leave-one-model-out protocol, where one generator is excluded from training and used only for testing. As shown in Table 1, ADRD achieves average ACC, AP, and AUC scores of 61.2%, 65.1%, and 65.9%, respectively. These results are lower than those obtained under the standard setting, which is expected because the detector must rely on reconstruction-discrepancy patterns learned from other generators rather than generator-specific cues. Still, the performance remains above chance in most cases, suggesting that ADRD captures features with certain cross-model transferability.

Download:

• PNG
  larger image
• TIFF
  original image

Table 1. Leave-one-model-out evaluation of ADRD across different diffusion generators.

https://doi.org/10.1371/journal.pone.0350655.t001

Mixed-training evaluation.

We further evaluate ADRD in a mixed-training setup, where all generators are combined during training and the trained model is evaluated separately on each generator. Table 2 summarizes the results. On average, ACC, AP, and AUC reach 68.9%, 74.9%, and 73.9%, corresponding to absolute improvements of 7.7, 9.8, and 8.0 percentage points over the leave-one-model-out baseline. This pattern suggests that exposing ADRD to more diverse generator distributions help it learn reconstruction-discrepancy cues that are less tied to a single source. Improvements are especially visible on ADM, Glide, Midjourney, SD v1.5, and VQDM. At the same time, SD v1.4 and Wukong show relatively limited gains, indicating that simply mixing more generators into the training pool is not sufficient to fully close the cross-model generalization gap.

Download:

• PNG
  larger image
• TIFF
  original image

Table 2. Mixed-training evaluation of ADRD across different diffusion generators.

https://doi.org/10.1371/journal.pone.0350655.t002

Compare with the state of the arts

We compare ADRD with different detection methods on GenImage benchmark, shown in Table 3. Early GAN-based detectors [47,48] work poorly on diffusion images, with both ACC and AP below 60%. While universal detectors [16,35,49] despite incorporating optimizations for diffusion models, their performance varies significantly across generators, typically achieving ACC/AP between 55% and 75%. Recent methods like AIDE [50], C2P-CLIP [51], and FIRE [38] further improve the overall performance, especially in terms of AP.

Download:

• PNG
  larger image
• TIFF
  original image

Table 3. Comprehensive comparisons between our ADRD and baselines.

https://doi.org/10.1371/journal.pone.0350655.t003

Under the same evaluation protocol, ADRD achieves an overall ACC/AP of 68.9 ± 6.9% / 74.9 ± 5.9%. Compared with existing methods, ADRD obtains competitive average accuracy and performs favorably on several generators. However, ADRD does not consistently outperform all competing methods. In particular, its average AP remains lower than several recent detectors. This indicates that although the proposed reconstruction-response signal is effective, it does not fully replace the stronger discriminative cues captured by recent detection models.

We attribute this gap to the inherent variability of reconstruction sensitivity across generators. For SD v1.4, SD v1.5, and Wukong, the probe-induced discrepancy separates real and generated samples less clearly, leading to weaker AP. Overall, ADRD offers a complementary perspective: instead of relying on passive reconstruction errors or visual features, it actively probes how real and generated images respond differently to optimized latent perturbations.

Reconstruction discrepancy analysis

To evaluate the effect of the learned probe, we compare the latent-space reconstruction discrepancy under 3 settings: without probe, random probe, and optimized probe. The discrepancy is measured by the distance between the perturbed latent representation and its reconstruction.

As shown in Fig 6, real and generated samples have highly overlapping discrepancy distributions without probe applied. The random probe leads to only a small shift in the distributions, and the 2 classes remain difficult to separate. By contrast, the optimized probe increases the discrepancy of real images more substantially, while generated images remain concentrated in a lower discrepancy range.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 6. Reconstruction discrepancy distributions under different probing settings.

Box plots compare discrepancies between real and diffusion-generated images for without probe, random probe, and optimized probe conditions. The optimized probe yields the clearest separation.

https://doi.org/10.1371/journal.pone.0350655.g006

This result indicates that the optimized probe is not equivalent to injecting random noise. Instead, it exposes differences in the reconstruction responses of real and diffusion-generated images, making the latent space reconstruction discrepancy more useful for detection.

Probing perturbation

To assess the contribution of probing perturbation in latent space to detection performance, we compared 3 settings under the same training/testing protocol: Without probe, Random probe, and Optimized probe (learned through our optimization strategy). ACC/AP are reported separately for 8 diffusion generators (ADM, BigGAN, Glide, Midjourney, SD v1.4, SD v1.5, VQDM, Wukong). All results represent the mean ± std deviation from 5 independent trials, as shown in Table 4.

Download:

• PNG
  larger image
• TIFF
  original image

Table 4. Detection performance under different probing perturbation settings across image generators.

https://doi.org/10.1371/journal.pone.0350655.t004

The results demonstrate that introducing probing perturbation enhances detection performance to some extent, with the optimized probe outperforming the random probe. Compared with the Random probe, the optimized probe improves the overall average ACC/AP from 60.9 ± 2.5% / 64.6 ± 2.7% (ACC/AP) to 66.7 ± 4.2% / 71.1 ± 6.6%, corresponding to absolute improvements of +5.8 / + 6.5 percentage points. This phenomenon suggests that perturbation optimization targeting the “reconstruction discrepancy” objective can yield more discriminative reconstruction responses, rather than merely introducing additional noise.

Image pairs in optimizing probe

To enhance the cross-generator applicability of probing perturbation, we further investigate the impact of different numbers of “real – generated image pairs” during the perturbation optimization phase on final detection performance and computational cost, as shown in Fig 7. The results indicate that as the number of image pairs increased, the detection performance (ACC/AP/AUC) generally shows an upward trend, suggesting that more pairs provide a more stable optimization signal. However, concurrently, the runtime for perturbation optimization also significantly increases. Based on the magnitude of detection performance improvement balanced against the runtime overhead, we select 8 image pairs as the default setting for subsequent experiments. This setting achieves performance close to that obtained with larger sets of image pairs while preventing a significant runtime increase, thus striking a reasonable trade-off between effectiveness and efficiency.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 7. Impact of the number of image pairs on detection performance and computational cost during the perturbation optimization phase.

https://doi.org/10.1371/journal.pone.0350655.g007

The figure compares the trends observed when using different numbers of “real image–diffusion-generated image pairs” for learning probing perturbation. As the number of image pairs increases, metrics (ACC/AP/AUC) improve overall, but the runtime also increases accordingly, demonstrating a trade-off between performance and computational cost.

Diffusion reconstruction

To further analyze the role of diffusion reconstruction in ADRD, we conducted an ablation study on strength parameter. This parameter controls the level of noise injected into the input before reconstruction, thereby establishing a continuous trade-off between “preserving input structural information” and “relying on the generative prior of diffusion model.”

When strength = 0, the reconstruction effectively degenerates into an approximate identity mapping. Consequently, the resulting reconstruction error is near-zero, failing to elicit sufficient discriminative differences in reconstruction stability. This leads to detection performance close to random guessing (AUC = 0.477). Conversely, when strength = 1.0, the input is completely noised. The reconstruction is then primarily governed by the generative prior of diffusion model, significantly weakening the individual characteristics of the input image. This causes the reconstruction of 2 image classes to become more homogeneous, partially obscuring discriminative signals, and results decrease compared to intermediate strength values (AUC = 0.610). As illustrated in Fig 8, reconstruction with an intermediate strength value (strength = 0.6) achieved the best performance (AUC = 0.690). This indicates that within this range, the reconstruction process retains sufficient input structure while simultaneously introducing adequate noise and reverse diffusion iterations, thereby generating stronger discriminative signals for detection. Therefore, a strength value of 0.6 was adopted as the default setting for subsequent experiments.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 8. Comparison of ROC curves under different diffusion reconstruction strengths (on GenImage).

The x-axis represents FPR, and the y-axis represents TPR. Detection performance exhibits significant variation with changes in strength: the legend provides the corresponding AUC values for each setting.

https://doi.org/10.1371/journal.pone.0350655.g008

Impact of different classifiers

In our experiments, we compared 4 different classification methods: (1) Support Vector Machine (SVM) as a traditional machine learning baseline; (2) SimpleCNN, a shallow convolutional neural network; (3) BetterCNN, a convolutional neural network with deeper feature extraction capabilities; (4) AttentionCNN, a convolutional neural network incorporating an attention mechanism.

The performance comparison for these classifiers across 3 metrics (ACC/AP/AUC) is presented in Table 5. The results indicate notable performance differences among classifiers. SVM demonstrates relatively lower overall performance, suggesting that the reconstruction difference features are not entirely linearly separable. In contrast, SimpleCNN, by introducing a convolutional structure, effectively leverages local spatial information within the reconstruction difference tensor, achieving significant improvements across all metrics. BetterCNN achieves the optimal results in ACC/AP/AUC, indicating that deeper feature extraction facilitates the capture of more subtle variations in the reconstruction error within latent space. Although AttentionCNN introduces an explicit attention mechanism, its performance improvement was limited; this is likely due to the low spatial resolution of latent space difference tensor. Overall, the experimental results demonstrate that BetterCNN achieves the best balance between performance and model complexity.

Download:

• PNG
  larger image
• TIFF
  original image

Table 5. Performance comparison of different classifiers on GenImage.

https://doi.org/10.1371/journal.pone.0350655.t005

Robustness to common propagation degradations

Beyond generalization capability for unseen diffusion-generated images, robustness against unseen interference constitutes another critical evaluation metric. In actual applications, images transmitted through network platforms are inevitably subjected to noise and compression. Therefore, we evaluated the robustness of ADRD under 2 interference types: Gaussian blur and JPEG compression. The degradations are applied at 4 levels for Gaussian blur in pixel space and 4 levels for JPEG compression . The test results for different diffusion-generated images are shown in Fig 9. We observe that the detection performance (ACC/AP/AUC) exhibited a decline under increasing Gaussian blur intensity. This degradation became more pronounced when σ exceeded 0.1. In contrast, across the tested range of JPEG compression levels, the 3 metrics (ACC/AP/AUC) demonstrate minimal variation, indicating that ADRD possesses good stability against common compression distortions.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 9. Robustness to common propagation degradations.

(A) Robustness against different Gaussian blur. (B) Robustness against different JPEG compression. (A) It indicates robustness against different levels of Gaussian blur, where larger signifies higher blur. (B) Robustness under different JPEG quality levels, where a higher quality value indicates lower compression. ACC(%), AP(%) and AUC(%) are reported above.

https://doi.org/10.1371/journal.pone.0350655.g009

Computational complexity analysis

We report the computational costs associated with our proposed method. This includes the reconstruction time per image, classifier inference time per image, and total processing time. We further convert the total time into GPU hours required to process 8,000 test images. These measurements exclude the computational time required for probing perturbation optimization. All measurements were conducted on a single NVIDIA TITAN RTX GPU, with a batch size of 4, an input resolution of 256 × 256, and a total of 8,000 images.

As illustrated in Table 6, the primary computational overhead in ADRD stems from the diffusion reconstruction. The additional overhead introduced by subsequent difference calculation and CNN-based classifier inference is negligible. Under the default DDIM reconstruction settings, ADRD requires approximately 0.94 GPU hours to process 8,000 images, thus making it suitable for offline analysis. Compared to lightweight detectors that do not rely on reconstruction, ADRD exhibits higher latency per image. Its applicability in scenarios with stringent real-time requirements remains constrained by computational cost. Future work will explore more efficient reconstruction strategies and acceleration techniques to further reduce GPU resource consumption.

Download:

• PNG
  larger image
• TIFF
  original image

Table 6. Computational complexity comparison of different methods.

https://doi.org/10.1371/journal.pone.0350655.t006