1 Introduction↩︎

AIGI detection is characterized by a strong adversarial nature driven by the rapid evolution of generative models. In the early stages, detection methods achieved remarkable success by exploiting explicit low-level artifacts, such as periodic upsampling anomalies in the frequency domain [1], [2] or structural inconsistencies rooted in neighborhood pixel relationships [3]. With the rise of diffusion models, the paradigm evolved to leverage reconstruction discrepancies [4], intrinsic forgery subspaces [5], [6], or pixel-level trajectories [7]. More recently, to mitigate semantic overfitting, researchers have pivoted to harnessing the rich priors of large-scale foundation models, fusing high-level semantics with forensic features [8]–[12]. Crucially, despite their methodological differences, these paradigms all operate under the “static artifact hypothesis”: they assume that by extracting intrinsically invariant features from historical data, a detector can achieve universal zero-shot generalization against unseen, future generative models. Under this hypothesis, current state-of-the-art (SOTA) methods have demonstrated near-perfect performance on established benchmarks like GenImage [13], creating a widespread perception that the task is largely solved within these closed-set environments.

However, image generation is witnessing an explosion, spanning from Generative Adversarial Networks [14]–[16] to Diffusion Models [17]–[19] and emerging Autoregressive Transformers MaskGit?. This evolution introduces unpredictable artifacts that lead to significant shifts in generative distribution. Thus, the decision boundaries of static models fail to segregate novel forgery features from the seen data manifold, rendering pre-trained “invariant” features ineffective. Consequently, we observe a catastrophic performance collapse against these unseen models: as evidenced in Figure 1 (b), SOTA detectors that achieve saturation on GenImage plummet to near-random or even 0.12% accuracy when tested against advanced closed-source engines like Nano Banana Pro. This dramatic failure underscores a critical reality: strictly adhering to a fixed feature space is no longer viable for open-world defense, where the adversary is continuously evolving.

To address these limitations, we propose a paradigm shift from “static generalization” to “dynamic adaptation.” Instead of seeking a universal “silver bullet” feature, we advocate for a forensic system capable of evolving alongside the adversary. To this end, we introduce Fleet, a framework that pioneers a dynamic paradigm of continuous few-shot evolution, enabling rapid alignment with emerging generative threats. By shifting the core objective from discovering static invariants to constructing a malleable decision space, Fleet allows for precise adaptation to novel artifacts while constraining the drift of the Non-AI manifold.

Specifically, Fleet reformulates adaptation as information flow regulation via a mutually exclusive subspace routing framework. Leveraging orthogonal constraints encourages distinct routing preferences over Non-AI-oriented and AI-oriented subspaces. Crucially, Fleet employs an avoidance routing mechanism to execute a “Shunt-and-Isolate” strategy: explicitly steering novel artifacts into the forgery subspace while suppressing their activation in the Non-AI manifold. This ensures precise adaptation to emerging models while mitigating perturbation to authentic-image representations, effectively concentrating updates within the discriminative forgery subspace.

While datasets have evolved from controlled baselines like CNNDect [1] and GenImage [13] to “in-the-wild” challenges such as WildFake [20], Chameleon [21], and AIGIBench [22], even these contemporary benchmarks lag behind the explosion of heterogeneous and closed-source commercial engines. This lag creates a critical evaluation blind spot that masks the fragility of the static generalization paradigm (Figure 1 (a)). To bridge this gap, we present Treasure, a frontier benchmark encompassing 360k images from 64 mainstream models, explicitly integrating 20 closed-source engines and pioneering a multi-dimensional evaluation protocol covering architecture, semantics, and artistic style. Leveraging this comprehensive benchmark, we systematically expose the generalization failure of existing SOTA AIGI detection methods and rigorously validate the efficacy of our proposed Fleet framework.

Our contributions are summarized as follows:

• New Paradigm: We expose the failure of the static artifact hypothesis and propose a dynamic paradigm of continuous few-shot evolution.

• New Method: We introduce Fleet, a subspace routing framework that leverages avoidance routing to adapt to novel forgeries efficiently while maintaining stable Non-AI representations with limited drift.

• New Benchmark: We construct Treasure, a benchmark integrating closed-source engines and multi-dimensional annotations to rigorously stress-test adaptation in open-world scenarios.

2 Related Work↩︎

2.1 Current Datasets for AIGI Detection↩︎

The advancement of detection methods is inextricably linked to the evolution of benchmark datasets. Early research primarily relied on datasets constructed within controlled laboratory environments. CNNDect [1] established a foundation using ProGAN [23] and LSUN [24] to test 11 architectures, though its complexity now falls behind modern generators. To bridge the widening distribution gap, GenImage [13] constructed million-scale, category-aligned GAN/diffusion data via ImageNet prompts, while Fake2M [25] explored machine perception disparities. However, these lab-centric benchmarks often neglect the post-processing and stylistic diversity of real-world scenarios.

Consequently, research has pivoted toward “in-the-wild” challenges. WildFake [20] leverages open-source data encompassing diverse styles (e.g., anime, 3D rendering) and multi-stage pipelines. To probe detector limits, Chameleon [21] employs human-machine collaboration to create high-difficulty samples that challenge existing SOTA models. Finally, AIGIBench [22] first decouples traditional metrics into true/false accuracy, enabling systematic evaluation of multi-source generalization capabilities and robustness.

2.2 Generalized AIGI Detection Methods↩︎

AIGI detection has evolved from isolated supervised learning stages to open-world generalization and rapid adaptation phases. Current approaches primarily fall into two paradigms: zero-shot detection and few-shot detection. The distinction lies in whether target category information is leveraged during the inference process.

0.42ex plus 0.1ex minus 0.1ex-0.8emZero-Shot Methods Early research primarily focused on CNN generators, where CNNDect [1] and FreqNet [2] utilized periodic upsampling artifacts in spatial and frequency domains,while NPR [3] captured structural artifacts via neighborhood pixel relationships. With the rise of diffusion models, reconstruction-based metrics became prevalent. For instance, DIRE [4] leverages reconstruction discrepancies from pre-trained diffusion models to localize forged regions. [5] and Effort [6] construct intrinsic forgery subspaces through orthogonal decomposition or self-supervised filtering. Additionally, [7] proposed pixel-level mapping (PLM), which disrupts high-level semantics through preprocessing to force the model to generate generalizable pixel-level trajectories, thereby mitigating semantic overfitting.

Given the fragility of explicit artifacts, recent research has pivoted toward leveraging extensive priors from large-scale pre-trained models. CLIPDetection [8] and C2P-CLIP [10] utilize frozen or fine-tuned CLIP encoders for classification, while AIDE [9] enhances robustness by fusing high-level CLIP semantics with low-level DCT-derived statistical features. To mitigate feature entanglement caused by task-irrelevant semantic interference, VIB-Net [11] and CausalCLIP [12] employ information bottlenecks or adversarial learning for feature filtration.

The zero-shot paradigm aspires to capture the invariant essence of generative models in pursuit of ultimate generalization. However, confronted with the heterogeneity of generator architectures and the leap in generation quality, such static priors prove overly idealistic and fragile against rapidly evolving “Zero-Day” threats. In contrast, few-shot learning emerges as a pragmatic compromise: by leveraging minimal priors to surmount the barriers of distribution shift, it trades minimal data costs for rapid response capabilities against unknown attacks.

0.42ex plus 0.1ex minus 0.1ex-0.8emFew-Shot Methods [26] demonstrates that leveraging CLIP features allows for achieving robust model generalization with only a handful of samples. FSD [27] pioneered the incorporation of metric learning from few-shot learning into the realm of AIGI detection. Subsequently, FAMSeC [28] integrated CLIP with LoRA [29] to propose a forgery-aware module and a semantic-guided contrastive learning strategy, significantly enhancing detection robustness even with extremely limited data. Furthermore, FTNet [30] introduced a training-free framework utilizing “failed samples”; by mining hard samples misclassified by the model to dynamically maintain a sample gallery, it achieves rapid adaptation in few-shot scenarios.

Despite recent approaches integrating few-shot learning techniques, current AIGI detection methods suffer from architectural deficiencies and evaluation blind spots. Primarily, reliance on training-free static prototype matching fails to capture novel forgery artifacts from emerging generators, leading to prototype drift and false alarms on authentic samples. Furthermore, existing approaches often neglect catastrophic forgetting during continual adaptation, myopically focusing on short-term performance on isolated tasks. To bridge these gaps, we propose a feature fine-tuning method to effectively capture novel generative features and pioneer the introduction of an anti-forgetting metric, significantly enhancing the practical utility of few-shot AIGI detection.

3 Construction of Treasure↩︎

This section details the construction of Treasure, a large-scale benchmark designed to address the performance saturation and distribution lag in existing datasets. To provide a more rigorous evaluation environment for few-shot AIGI detection, this work systematically designs a diverse data collection pipeline and a multi-faceted analysis framework. The following subsections elaborate on the data acquisition process, quality control approaches, and the distinctive characteristics of the benchmark.

3.1 Data Collection↩︎

0.42ex plus 0.1ex minus 0.1ex-0.8emNon-AI Images Prior studies typically define “Real” as naturally captured camera images. However, the ubiquity of generative technologies in advertising and media necessitates expanding the concept opposing “Fake” to encompass all non-AI-generated content, termed “Non-AI” In Treasure, Non-AI images are sourced from COCO2014 and cc12m-2mp-realistic. While COCO2014 provides samples aligned with traditional “Real” distributions, cc12m contributes movie posters, illustrations, and documents to ensure diversity in semantics, artistic styles, and resolutions.

0.42ex plus 0.1ex minus 0.1ex-0.8emAI Images To enhance scale and diversity, images are curated through three distinct channels: (i) random sampling of 27 generator categories from public benchmarks and open-source communities; (ii) local generation from 21 open-source models ; and (iii) API-based generation from 16 commercial platforms. Detailed model specifications are provided in Appendix 7.3. Furthermore, a comprehensive prompt library is constructed for text-to-image (T2I) sampling. Inspired by OmniDFA [31], this library employs four complementary subsets designed to span the semantic spectrum from concise instructions to granular textual descriptions , with compositional details elaborated in Appendix 7.2.

0.42ex plus 0.1ex minus 0.1ex-0.8emQuality Control To ensure a uniform semantic distribution, feature embedding and similarity-based deduplication are applied to all images and prompts. Specifically, features are extracted using a pre-trained DINOv3 model to facilitate cosine similarity-based deduplication during image sampling. Similarly, prompt encodings are computed using the Qwen3-embedding [32] model, with deduplication performed on normalized feature vectors. Further filtering is executed based on prompt length and content sensitivity.

3.2 Analysis↩︎

The Treasure benchmark comprises 64 distinct generative categories, each containing approximately 5,000 high-resolution images, supplemented by two Non-AI image sources with 20,000 samples each, totaling about 360k images. As illustrated in Figure 2 (a), Treasure introduces novel artistic style annotations alongside standard binary and category labels. Leveraging the Qwen3-VL model, all samples are categorized into four stylistic domains—photorealism, 2D illustration, 3D rendering, and traditional art—providing a new dimension for multi-faceted generalization assessment. In summary, Treasure aggregates the most prevalent and advanced generative models, exhibiting extensive diversity in architecture, semantics, and style. It represents a highly realistic and challenging evaluation environment specifically engineered for the few-shot AIGI detection task. As shown in Figure 2 (d-f), it demonstrates significant advantages over other works in terms of diversity, scale, and novelty.

4 Method↩︎

In this section, we present Fleet, a mutually exclusive subspace routing method. An overview of Fleet is illustrated in Figure 3.

4.1 Subspace Routing Framework↩︎

Leveraging the sensitivity of high-frequency components to low-level traces ([2]; [33]) and the robustness of pre-trained models ([8], [34]), we design a dual-branch architecture: the high-frequency components branch guides subspace routing, while the pre-trained branch handles feature extraction and discrimination.

0.42ex plus 0.1ex minus 0.1ex-0.8emSubspace Projection We employ the pre-trained DINOv3 [35] vision large model as the backbone \(E_{\mathrm{vis}}\) and specialize in its capabilities for the forgery detection task via a Low-Rank Adaptation (LoRA) matrix \(\Delta\theta_{\mathrm{lora}}\). For an input image \(x\), we first extract its feature vector \(\mathbf{z}\): \[\mathbf{z} = E_{\mathrm{vis}}(x; \theta_{\mathrm{dino}} + \Delta\theta_{\mathrm{lora}}) \in \mathbb{R}^{D}.\]

Here, \(\mathbf{z}\) is a high-dimensional backbone representation. We use lightweight linear projections to parameterize multiple learnable subspaces. These projections generate subspace addresses for routing and subspace features for representation aggregation. Together with frequency-guided routing, orthogonality and coverage constraints, and avoidance routing during adaptation, this design promotes effective feature decoupling across AI and Non-AI responses, enabling Fleet to adapt to emerging generators while maintaining stable performance on previously learned data.

To this end, we define two sets of subspace-specific linear projection parameters: \(\{(\mathbf{W}^{\mathrm{addr}}_i, \mathbf{b}^{\mathrm{addr}}_i)\}_{i=1}^C\) and \(\{(\mathbf{W}^{\mathrm{feat}}_i, \mathbf{b}^{\mathrm{feat}}_i)\}_{i=1}^C\). For the \(i\)-th feature subspace, its corresponding subspace address \(\mathbf{a}_i\) and subspace feature \(\mathbf{s}_i\) are computed via the following affine transformations: \[\begin{align} \mathbf{a}_i &= \mathbf{W}^{\mathrm{addr}}_i\mathbf{z} + \mathbf{b}^{\mathrm{addr}}_i, \\ \mathbf{s}_i &= \mathbf{W}^{\mathrm{feat}}_i\mathbf{z} + \mathbf{b}^{\mathrm{feat}}_i, \quad i \in \{1, \dots, C\}, \end{align}\] where \(\mathbf{W}^{(\cdot)}_i \in \mathbb{R}^{d \times D}\) denotes the projection weight matrix, and \(\mathbf{b}^{(\cdot)}_i \in \mathbb{R}^{d}\) is the corresponding bias vector. Specifically, \(\mathbf{a}_i\) serves as the addressing signature for the \(i\)-th subspace, utilized for matching during the routing phase, while \(\mathbf{s}_i\) represents the corresponding subspace feature to be activated. In our implementation, we set \(D=1024\) and \(d=128\).

0.42ex plus 0.1ex minus 0.1ex-0.8emHigh-Frequency Component-Guided Subspace Routing To capture the low-level high-frequency features of the image, we adopt an image processing approach similar to FreqNet. First, we perform a Fast Fourier Transform (FFT) on the input image \(x\) and zero out the low-frequency components to thoroughly eliminate semantic interference, preserving only the high-frequency signals sensitive to the generation mechanism: \[\mathbf{X}_{\mathrm{high}} = \mathcal{F}^{-1}( \mathcal{F}(x) \odot \mathbf{M}_{\mathrm{high}} ),\] where \(\mathcal{F}(\cdot)\) and \(\mathcal{F}^{-1}(\cdot)\) denote the FFT and its inverse, respectively; \(\mathbf{M}_{\mathrm{high}}\) is a high-pass filter; and \(\odot\) denotes element-wise multiplication. Subsequently, the processed high-frequency component \(\mathbf{X}_{\mathrm{high}}\) is fed into a convolutional encoder \(E_{\mathrm{freq}}\). Since the high-frequency component contains low-level forgery traces, \(E_{\mathrm{freq}}\) can extract semantic-agnostic high-frequency features, generating a high-frequency component-guided routing signal \(\mathbf{r}_{\mathrm{freq}}\): \[\mathbf{r}_{\mathrm{freq}} = E_{\mathrm{freq}}(\mathbf{X}_{\mathrm{high}}) \in \mathbb{R}^{d}.\] We utilize the dot product between the routing signal \(\mathbf{r}_{\mathrm{freq}}\) and each subspace address \(\mathbf{a}_i\) as a gating network, employing the Softmax function to generate the normalized routing distribution weights \(\boldsymbol{\alpha} \in \mathbb{R}^C\): \[\alpha_i = \frac{\exp((\mathbf{r}_{\mathrm{freq}}^{\top}\mathbf{a}_i)/\sqrt{d})}{\sum_{j=1}^{C} \exp((\mathbf{r}_{\mathrm{freq}}^{\top}\mathbf{a}_j)/\sqrt{d})}.\] The Softmax function introduces a competitive flow control mechanism: when the avoidance mechanism forcibly suppresses the path to the Non-AI subspace, the normalization property compels the information flow of forgery features from unseen model images to automatically redirect toward the most relevant forgery subspace. The final output feature \(\mathbf{h}_{\mathrm{final}}\) is the weighted concatenation of subspace features, processed through a projection network \(P(\cdot)\) for feature fusion and mapping: \[\mathbf{h}_{\mathrm{final}} = P\left( \text{Concat}(\alpha_1 \mathbf{s}_1, \dots, \alpha_C \mathbf{s}_C) \right),\] where \(\text{Concat}(\cdot)\) denotes the concatenation operation along the feature dimension. The output feature \(\mathbf{h}_{\mathrm{final}}\) is then utilized to construct prototype vectors for Non-AI/AI categories for the final classification.

4.2 Mutually Exclusive Routing Pre-training↩︎

To ensure the effectiveness of the routing mechanism, it is imperative to enforce functional differentiation among the \(C\) subspaces during the pre-training phase.

0.42ex plus 0.1ex minus 0.1ex-0.8emContrastive Learning Loss \(\mathcal{L}_{\mathrm{cls}}\) We employ the InfoNCE loss to construct a discriminative feature space: \[\mathcal{L}_{\mathrm{cls}}=-\frac{1}{B}\sum_{i=1}^{B}\log\frac{\exp(\text{sim}(\mathbf{h}_i,\mathbf{h}_{\mathrm{pos}})/\tau)}{\sum_{j\neq i}\exp(\text{sim}(\mathbf{h}_i,\mathbf{h}_j)/\tau)} ,\] where \(\mathbf{h}_{i}\) denotes the anchor sample, \(\mathbf{h}_{\mathrm{pos}}\) represents a positive sample sharing the same category as the anchor, and \(\mathbf{h}_{j}\) indicates a negative sample from a different category within the batch. \(B\) and \(\tau\) denote batch size and temperature.

0.42ex plus 0.1ex minus 0.1ex-0.8emNon-AI/AI Routing Orthogonality Constraint \(\mathcal{L}_{\mathrm{orth}}\) We compute the average routing weights for Non-AI samples, \(\bar{\boldsymbol{\alpha}}_{\mathrm{Non\text{-}AI}}\), and for AI samples, \(\bar{\boldsymbol{\alpha}}_{\mathrm{AI}}\), within a batch. By minimizing the dot product between them, we compel the subspaces to become mutually exclusive between the “Non-AI” and “AI” domains: \[\mathcal{L}_{\mathrm{orth}}=\sum_{c=1}^{C}\bar{\boldsymbol{\alpha}}_{\mathrm{Non\text{-}AI}}[c]\cdot\bar{\boldsymbol{\alpha}}_{\mathrm{AI}}[c],\] where \(C\) represents the number of subspaces.

0.42ex plus 0.1ex minus 0.1ex-0.8emCoverage Constraint \(\mathcal{L}_{\mathrm{cov}}\) To prevent feature collapse and ensure that every subspace dimension is effectively utilized, we introduce a coverage constraint: \[\mathcal{L}_{\mathrm{cov}}=-\frac{1}{C}\sum_{c=1}^{C}\log(\bar{\boldsymbol{\alpha}}_{\mathrm{Non\text{-}AI}}[c]+\bar{\boldsymbol{\alpha}}_{\mathrm{AI}}[c]+\epsilon),\] where \(\epsilon\) is a small positive constant to prevent numerical instability (i.e., \(\log(0)\)).

0.42ex plus 0.1ex minus 0.1ex-0.8emTotal Pre-training Loss The total loss during the pre-training phase is defined as:\[\mathcal{L}_{\mathrm{pre}}=\mathcal{L}_{\mathrm{cls}}+\lambda_{\mathrm{orth}}\mathcal{L}_{\mathrm{orth}}+\lambda_{\mathrm{cov}}\mathcal{L}_{\mathrm{cov}}.\]

4.3 Few-Shot Adaptation via Avoidance Routing↩︎

During the adaptation phase, to address the issue where images generated by the novel model unexpectedly trigger activations in the non-AI subspace, we propose an avoidance routing strategy. Initially, we randomly select 1,000 Non-AI and AI images from the training set to construct a replay set \(\mathcal{M}\), following established practices in continual learning [36].

Computation of Replay Anchors. We leverage the replay set \(\mathcal{M}\) to compute the fixed anchor distributions (centroids) established during the pre-training phase: \[\begin{align} \boldsymbol{\mu}_{\mathrm{Non\text{-}AI}} &= \frac{1}{|\mathcal{M}_{\mathrm{Non\text{-}AI}}|}\sum_{x\in\mathcal{M}_{\mathrm{Non\text{-}AI}}}\boldsymbol{\alpha}(x), \\ \boldsymbol{\mu}_{\mathrm{AI}} &= \frac{1}{|\mathcal{M}_{\mathrm{AI}}|}\sum_{x\in\mathcal{M}_{\mathrm{AI}}}\boldsymbol{\alpha}(x) . \end{align}\] 0.42ex plus 0.1ex minus 0.1ex-0.8emAvoidance Loss \(\mathcal{L}_{\mathrm{avoid}}\) We compel the routing distributions of novel samples within the support set \(\mathcal{S}\) to “evade” incorrect anchors. Specifically, we enforce orthogonality between novel AI samples and the Non-AI anchor, as well as between Non-AI samples and the AI anchor: \[\begin{align} \mathcal{L}_{\mathrm{avoid}} &= \frac{1}{|\mathcal{S}_{\mathrm{AI}}|}\sum_{i\in\mathcal{S}_{\mathrm{AI}}}(\boldsymbol{\alpha}_i\cdot\boldsymbol{\mu}_{\mathrm{Non\text{-}AI}}) \\ &\quad + \frac{1}{|\mathcal{S}_{\mathrm{Non\text{-}AI}}|}\sum_{j\in\mathcal{S}_{\mathrm{Non\text{-}AI}}}(\boldsymbol{\alpha}_j\cdot\boldsymbol{\mu}_{\mathrm{AI}}). \end{align}\]

0.42ex plus 0.1ex minus 0.1ex-0.8emAnti-Forgetting Distillation \(\mathcal{L}_{\mathrm{distill}}\) To mitigate catastrophic forgetting, we impose a distillation constraint on the replay set \(\mathcal{M}\), preserving the geometric configuration of replay samples within the feature space: \[\begin{align} \mathcal{L}_{\mathrm{distill}} = \frac{1}{|\mathcal{M}|}\sum_{k\in\mathcal{M}}\Big(1 - \text{sim}\big(&\mathbf{h}_{\mathrm{final}}^{\mathrm{curr}}(x_k), \\ &\mathbf{h}_{\mathrm{final}}^{\mathrm{old}}(x_k)\big)\Big), \end{align}\] where \(\mathbf{h}_{\mathrm{final}}^{\mathrm{curr}}\) and \(\mathbf{h}_{\mathrm{final}}^{\mathrm{old}}\) denote the features extracted by the current and previous model versions, respectively.

0.42ex plus 0.1ex minus 0.1ex-0.8emTotal Adaptation Loss The total loss function for the adaptation phase is formulated as: \[\mathcal{L}_{\mathrm{adapt}}=\mathcal{L}_{\mathrm{cls}}+\lambda_{\mathrm{avoid}}\mathcal{L}_{\mathrm{avoid}}+\lambda_{\mathrm{distill}}\mathcal{L}_{\mathrm{distill}}.\]

5 Experiment↩︎

5.1 Datasets and Evaluation Protocols↩︎

In the pre-training phase, to align with the setup used by zero-shot methods, we use the AIGIBench training set, which consists of 144k images generated by two models: ProGAN [23] and SD v1.4 [37]. In the few-shot adaptation phase, to rigorously evaluate the effectiveness of our method, we adopt two primary testing protocols: Protocol I conducts a few-shot evaluation on each category in the Treasure dataset, which encompasses 64 distinct generative models. Protocol II conducts a few-shot evaluation on each category in the public AIGIBench test set, which contains 13 testing subsets. Unlike previous works, we introduce the AIGIBench validation set as an indicator of anti-forgetting, allowing us to observe whether the few-shot adaptation process induces catastrophic forgetting. See Appendix 7.1 for more details.

5.2 Baselines and Evaluation Metrics↩︎

We compare our proposed method against two categories of state-of-the-art (SOTA) approaches: (1) Zero-shot methods: FreqNet [2], ClipDetection [8], AIDE [9], SAFE [38], and PLM [7]. (2) Few-shot methods: FSD [27]. Specifically, PLM, FSD, and SAFE are reproduced based on their official code repositories, while the remaining zero-shot methods utilize their official pre-trained weights. We evaluate the accuracy of each method on both AI and Non-AI classes within the test set (query set), as well as the accuracy on the anti-forgetting set. To further assess model performance, we also employ the Average Precision (AP) metric on the test set (query set). The threshold for the accuracy metric is set to 0.5.

5.3 Comparisons with State-of-the-art Methods↩︎

As presented in Table ¿tbl:tab:comparison-combined?, Fleet establishes a new state-of-the-art in few-shot AIGI detection by successfully resolving the conflict between rapid adaptability and baseline stability. First, our method demonstrates superior initialization capabilities. On the challenging Treasure benchmark, Fleet achieves a 1-shot accuracy of 76.08%, which not only approaches the performance of the SOTA zero-shot method PLM (76.56%) but also surpasses the 10-shot performance of the dedicated few-shot baseline FSD (68.28%). This counterintuitive result validates that our mutually exclusive routing pre-training constructs a highly structured feature space, allowing the model to align decision boundaries with minimal samples rather than learning from scratch. Second, Fleet exhibits exceptional data utilization efficiency in high-performance regimes. Even on AIGIBench, where the baseline accuracy is already saturated above 90%—a regime typically plagued by diminishing returns—Fleet continues to convert additional support samples into significant gains, improving accuracy from 92.12% (1-shot) to 97.68% (10-shot). This proves our method’s scalability in refining features without hitting early performance bottlenecks. Finally, we pioneer the inclusion of anti-forgetting metrics in the few-shot evaluation protocol to expose a critical vulnerability in existing methods. While FSD suffers from severe catastrophic forgetting, with accuracy on the validation set drawn from the pre-training distribution plummeting to 74.81%, Fleet leverages an effective replay mechanism to mitigate this issue and maintains near-perfect memory retention above 99.9%, ensuring robust continual adaptation without compromising historical knowledge.

5.4 Ablation Study↩︎

To comprehensively evaluate the effectiveness of each component, we conduct an in-depth analysis on 8 subsets of the Treasure dataset. These subsets were specifically selected because they cover diverse architectures and represent scenarios where zero-shot performance is sub-optimal.

0.42ex plus 0.1ex minus 0.1ex-0.8emLoss Function Analysis We analyze the impact of the loss functions in Table ¿tbl:tab:ablation-study?. Removing the avoidance loss results in a significant accuracy drop of 4.01%, indicating that the lack of explicit routing guidance causes the model to update incorrect subspaces, thereby impairing performance. Removing the coverage loss leads to a slight decrease of 0.86%, demonstrating the benefit of ensuring that every subspace is effectively utilized. Overall, removing all subspace-related design losses results in a 4.04% performance degradation, validating the necessity of our optimization objectives.

0.42ex plus 0.1ex minus 0.1ex-0.8emComparison with Baseline To demonstrate the superiority of our architectural design, we compare our method against a standard baseline. This baseline employs DINOv3 and LoRA, fine-tuned using contrastive and distillation losses under identical replay settings. Results show that our method outperforms this general baseline by 1.91%, proving that incorporating a subspace routing mechanism adapts more effectively to forgery detection tasks compared to generic PEFT schemes.

0.42ex plus 0.1ex minus 0.1ex-0.8emLoRA Rank Analysis We also ablate the rank hyperparameter of the low-rank adaptation (LoRA) modules used during sequential adaptation. The results show that rank = 8 yields the best overall trade-off, while performance differences across a reasonable range of ranks are limited. This indicates that Fleet is not highly sensitive to this hyperparameter. Detailed results are shown in Table ¿tbl:tab:lora95rank? .

0.42ex plus 0.1ex minus 0.1ex-0.8emHyperparameter Sensitivity Analysis We analyze the impact of the replay set size. As illustrated in Figure 4, when the size is reduced to 200 and 20, accuracy drops by 3.7% and 13.92%, respectively. This performance decline is primarily attributed to insufficient data, which limits the effectiveness of contrastive learning. However, the accuracy on the pre-training validation set remains above 99.9% across all settings, demonstrating that even with a minimal replay buffer, the model maintains excellent anti-forgetting performance in forgery detection tasks. Regarding the number of subspaces, we evaluated settings of \(\{2, 4, 8, 16, 32\}\). The experiments indicate that the model achieves the highest accuracy when the number of subspaces is set to 8.

5.5 Robustness Experiment↩︎

In real-world transmission and interaction scenarios, images inevitably encounter various unseen perturbations and degradations, posing a severe challenge to the practical deployment of AI-generated image detectors. Experimental Setup: to ensure a fair and rigorous evaluation, all comparison models are tested without any specific data augmentation or robust training. They are directly exposed to varying intensities of post-processing. Specifically, the perturbations include JPEG compression (Quality Factor \(Q \in \{95, 90, 75, 50\}\)) and Gaussian blur (\(\sigma \in \{1.0, 2.0, 3.0, 4.0\}\)). As illustrated in Figure 5, due to the absence of robust training, most baseline methods exhibit a significant performance decline. In contrast, despite these challenging and degradative conditions, our method maintains exceptional stability, significantly outperforming other approaches.

5.6 Visualization↩︎

Analysis of Subspace Activations. As illustrated in Figure 6, functional specialization emerges during the pre-training phase: some subspaces activate exclusively for Non-AI images, while others respond solely to AI images. However, when encountering unseen realistic AI images, subspaces associated with Non-AI data may be erroneously triggered. In response, the Avoidance Loss explicitly rectifies the routing trajectory. Consequently, as shown in Figure 6 (a), following few-shot training, the activation of Non-AI-associated subspaces is effectively suppressed, whereas that of AI-associated subspaces is amplified.

5.7 Few-shot sequence adaptation↩︎

To further examine the behavior of our method beyond the single-step setting, we conducted a preliminary sequential adaptation experiment over five steps on previously unseen generators. The goal is to assess whether the detector can repeatedly adapt to new generators while retaining performance on earlier ones, using only a few samples per step.

The results are summarized in Table ¿tbl:tab:few-shot-seq?. After all five updates, the mean accuracy on the pretrain validation set remains 99.78% (compared to 99.98% before adaptation), indicating almost no forgetting of the original distribution. More importantly, performance on previously adapted generators is well maintained or even improves. For example, the accuracy on GPT-4o rises from 88.06% after its initial adaptation to 91.04% after subsequent updates on later generators. Similar trends are observed for other models (e.g., StarGAN, SDXL, CogView4, Seedream4.0). These results suggest that our method has promising potential for sequential adaptation beyond the single-step scenario, and we plan to investigate this direction more thoroughly in future work.

5.8 Analysis of Initialization and Routing Stability↩︎

We analyze two design choices in Fleet’s subspace mechanism: the initialization of subspace parameters, and whether the subspace address is input‑dependent (dynamic) or static. Although these are distinct aspects, both reflect degrees of freedom in how subspaces are constructed and selected. For initialization, we compare the default random initialization with a structured MoE‑style warm start inspired by partial re-initialization [39], where subspace projections are initialized through a pretrained low-dimensional projection layer. This leads to only a marginal change in accuracy (93.26% → 93.53%), while pretrain‑validation accuracy remains unchanged (99.95% → 99.95%), indicating that Fleet does not rely on special initialization tricks. For addressing, replacing the input‑dependent dynamic address with a fixed static prototype per subspace reduces overall accuracy from 93.26% to 92.21%, with the main drop occurring on the AI class. This shows that dynamic addressing is beneficial for modeling emerging generator artifacts. Fleet maintains routing stability during both pretraining and adaptation. \(\mathcal{L}_{\mathrm{orth}}\) encourages distinct routing patterns for AI and non-AI samples, while \(\mathcal{L}_{\mathrm{avoid}}\) prevents routing collapse. During adaptation, the model prioritises routing correction for the first five epochs before enabling the classification term, which reduces potential optimization conflicts. Detailed results are shown in Table 1.

6 Conclusion and Limitations↩︎

This work introduces Treasure, a comprehensive benchmark, and Fleet, a frequency-guided subspace routing framework, to address the performance collapse of AIGI detectors when facing emerging generators. By establishing a high-margin evaluation environment with 64 generative models, this work fills an important gap in benchmark coverage. Experimental results demonstrate that Fleet effectively mitigates feature submersion through mutually exclusive routing, achieving SOTA performance across multiple benchmarks while maintaining robustness against catastrophic forgetting. These contributions establish a practical and efficient paradigm for securing digital media against the rapid evolution of synthesis technologies.

Despite the advancements, several limitations remain. First, this research focuses exclusively on full-image generation; the generalizability of the proposed method to localized editing or face-swapping tasks requires further investigation. Second, the current paradigm is designed for single-step few-shot adaptation, whereas exploring continual few-shot learning represents a critical step toward practical deployment and will be a focus of future work. Finally, the reliance on a replay set to balance performance and knowledge retention incurs additional storage overhead, suggesting that the development of more efficiency-oriented, replay-free adaptation mechanisms remains a significant objective for subsequent research. Our future work will further explore these limitations.

Acknowledgements↩︎

This work was supported by the Institute Innovation Project of the Institute of Computing Technology, Chinese Academy of Sciences under Grant No. E561090.

Impact Statement↩︎

This research advances AI-generated image forensics to safeguard digital integrity and curb misinformation. By improving detector adaptability, this work strengthens defenses against evolving generative models and restores public trust in media. While forensic progress may incite an “arms race” regarding forgery sophistication, comprehensive benchmarks facilitate rigorous community evaluation. All efforts prioritize ethical standards and privacy regulations to ensure positive societal impact.

7 Appendix↩︎

7.1 Experimental Details↩︎

7.1.1 Model Architecture↩︎

We utilize DINOv3 as the backbone architecture. During the training process, the backbone parameters of DINOv3 remain frozen. We employ Low-Rank Adaptation (LoRA) with a rank of 8 and a scaling factor of 16. For the high-frequency component feature extraction module (\(E_{\mathrm{freq}}\)), we adopt the Xception model as the backbone and apply a high-pass filter to retain the top 50% of high-frequency components. A temperature parameter \(\tau = 0.07\) is used in the contrastive learning.

7.1.2 Pre-training Phase↩︎

The model is trained for 3 epochs with a batch size of 256 and a learning rate of \(1 \times 10^{-4}\). The loss weights are set as \(\lambda_{\mathrm{cls}} = 1\), \(\lambda_{\mathrm{orth}} = 0.1\), and \(\lambda_{\mathrm{cov}} = 10^{-4}\).

7.1.3 Few-Shot Adaptation Phase↩︎

Replay Set Construction: The replay set consists of 1,000 images drawn from the pre-training set, comprising 500 randomly selected AI-generated images and 500 Non-AI images.Support Set Source: To better align the distribution of non-AI images in the support set with that of AI images during adaptation, all non-AI images in the support set are sourced from the cc12m-2mp-realistic dataset.Training Configuration: Each training batch consists of two parts: all samples from the current support set (permanently included) plus 32 images alternately drawn from the replay set. The learning rate is set to \(3 \times 10^{-5}\), and training is conducted for 20 epochs.Loss Strategy: The base loss weights are \(\lambda_{\mathrm{cls}} = 5\), \(\lambda_{\mathrm{distill}} = 10\), and \(\lambda_{\mathrm{avoid}} = 20\). However, in the first 5 epochs, we set \(\lambda_{\mathrm{cls}} = 0\) to prioritize learning the correct routing path.

7.1.4 Preprocessing & Hardware↩︎

The high-frequency component branch employs random cropping during training and center cropping during testing. All experiments are conducted on 8 NVIDIA GeForce RTX 3090 GPUs. Under this setup, pre-training requires approximately 3 hours, while the adaptation phase for each subset takes about 30 minutes.

7.1.5 Datasets & Evaluation Scope↩︎

AIGIBench-13. In the main experiment, "AIGIBench-13" refers to a subset containing 13 whole-image generation datasets, specifically: ProGAN, R3GAN, StyleGAN3, StyleGAN-XL, StyleSwim, WFIR, DALLE-3, FLUX1-dev, GLIDE, Imagen3, Midjourney, SD3, and SDXL.

Ablation Study. The ablation study covers eight representative datasets to encompass a range of mainstream methodologies (pixel-space diffusion, GPT-based, flow matching, unified GANs, autoregressive, and multimodal diffusion transformers). These include: ADM, GPT-4o, FLUX.2, StarGAN, NextStep, Qwen-Image, HunyuanImage 3.0, and wan2.5-t2i-preview.

7.2 Collection of Prompts↩︎

Prompts serve as a critical determinant of the semantic distribution in generated imagery. To simulate the multifaceted generation requests encountered in real-world scenarios, simple category labels are eschewed in favor of a comprehensive library containing 25,000 candidate prompts. This library is structured into four complementary subsets, spanning the semantic spectrum from concise instructions to elaborate textual descriptions:

• Authentic User Input: Consists of 5,000 real-world prompts sourced from DiffusionDB [40]. This subset preserves characteristic user behaviors, such as idiosyncratic spelling, modifier stacking, and non-standard syntax, ensuring that synthesized content reflects actual application distributions.

• Long-form Descriptions: Includes 5,000 fine-grained descriptions generated by Blip3o-long [41], averaging 120 tokens. These prompts are designed to evaluate the generative model’s capacity for rendering intricate spatial relationships and detailed textures.

• Short-form Instructions: Comprises 10,000 concise descriptions from Blip3o-short [42], with an average length of 20 tokens, facilitating the assessment of model performance under sparse semantic constraints.

• Open-world Metadata: Contains 5,000 high-aesthetic-score texts from LAION-COCO-Aesthetic [43]. Focusing on captions, slogans, and stylistic descriptors, this subset enhances coverage across non-natural image domains, such as posters and UI designs.

We provide some examples in Table 2.

7.3 Collection of Non-AI/Fake Images↩︎

Tables ¿tbl:tab:real-source? and 1 respectively display the source and link information for Non-AI and Fake images in Treasure dataset.

7.4 Long-horizon continual few-shot adaptation.↩︎

We further evaluate Fleet under a longer sequential adaptation setting to study whether limited replay data for earlier generators can cause retention or adaptation degradation. Specifically, we construct a 20-stage generator sequence, where each stage introduces one new generator with few-shot supervision. Since the replay buffer has a fixed size, the relative proportion of samples from the original pretraining distribution gradually decreases as more adapted generators are included, making later stages more challenging.

As shown in Fig. 7, Fleet remains stable over the full sequence. The pretraining validation accuracy stays close to its initial level across all 20 stages, indicating that the model does not forget the original training distribution. The first five adapted generators also keep high query accuracy after later adaptations, showing that early new-class knowledge is not overwritten. For each newly introduced generator, few-shot adaptation consistently improves the query accuracy over both the zero-shot result and the before-training result. Although later stages may benefit from accumulated exposure to a broader set of generators, the main observation is that Fleet does not collapse under this longer and more constrained replay setting. This suggests that the proposed framework can support long-horizon deployment beyond the short sequential setting used in the main experiments.

7.5 More comparisons between Treasure and other datasets↩︎

Table 2 presents further comparisons between our dataset and other datasets, demonstrating that our work shows significant advantages in terms of model quantity, novelty, semantic diversity, and stylistic diversity.

7.6 Detailed Results of Comparative Experiments↩︎

In this section, we provide a detailed breakdown of Table ¿tbl:tab:comparison-combined?. Table ¿tbl:tab:aigi-detail? and Table ¿tbl:tab:treasure95detail? present the accuracies of various methods on AI-generated and non-AI images for each subset of the AIGIBench-13 and Treasure datasets, respectively. Table ¿tbl:tab:aigi-detail-val? and Table ¿tbl:tab:treasure95detail95val? report the accuracies on the pre-training validation set after the few-shot methods are fine-tuned separately on each subset of AIGIbench-13 and Treasure, respectively.

3pt

3pt

3pt

References↩︎