Learning to Falsify: Hierarchical Multiple Instance Learning for High Resolution AI-Generated Image Detection

This work is licensed under a Creative Commons Attribution 4.0 International License. MM ’26, Rio de Janeiro, Brazil © 2026 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-2213-4/2026/11 https://doi.org/10.1145/3767308.3836365

ACM Reference Format:

Haoran Chen, Daiqi Gao, Xinyuan Li, Yongwei Wang, Lei Zhu, Rui Cai, and Jianfeng Dong. 2026. Learning to Falsify: Hierarchical Multiple Instance Learning for High Resolution AI-Generated Image Detection. In Proceedings of the 34th ACM International Conference on Multimedia (MM ’26), November 10–14, 2026, Rio de Janeiro, Brazil. ACM, New York, NY, USA, 10 pages. https://doi.org/10.1145/3767308.3836365

Introduction

Recent advances in generative models, from GANs [1, 7, 13, 29] to diffusion-based methods [5, 9, 24, 30], have made it possible to synthesize highly photorealistic images at scale. As these synthetic images become increasingly indistinguishable from real photographs, their misuse poses growing societal risks, including privacy violations, identity forgery, and the spread of misinformation. Consequently, developing reliable and generalizable detectors for AI-generated images has become an urgent and important problem.

Despite substantial progress in AI-generated image detection [15, 16, 17, 41, 42], most existing methods still follow a holistic image-level classification paradigm. To fit standard visual backbones [8, 26], they typically either resize the entire image to a fixed resolution [6, 36, 39] or use a single local crop as a proxy for the full image [3, 42, 45]. The resulting input is then compressed into a global representation for image-level classification. As illustrated in Figure 1(a), this paradigm is poorly suited for detecting localized artifacts. Resizing may suppress fine-grained forensic cues, single-crop inference only provides partial spatial coverage, and global representations diminish the influence of artifacts confined to local regions. These limitations become more severe for high-resolution images, where fixed-size resizing causes substantial loss of local details and a single crop captures only a small fraction of the image.

Vector (PDF)

To overcome this limitation, we draw inspiration from counterexample based falsification in mathematics, where a single counterexample suffices to refute a universal claim. We accordingly introduce the falsification-inspired principle for AI-generated image detection: a single fake region suffices to reject image authenticity, whereas accepting an image as real requires all its regions to be authentic. Based on this principle, we propose Learning to Falsify (LTF), a hierarchical multiple instance learning framework for identifying localized generative artifacts. As illustrated in Figure 1(b), LTF avoids resizing the image or using a single crop. Instead, it retains each image at its original resolution and partitions it without discarding pixels, thereby preserving full spatial coverage and fine-grained forensic details. These local regions are further organized into a hierarchical bag structure: each image forms a tile-level bag whose instances are image tiles, and each tile forms a patch-level bag composed of local patches. This design represents each image with one tile-level bag and multiple patch-level bags, enabling LTF to search for suspicious evidence at multiple granularities. Under the falsification-driven principle, a few suspicious instances within any bag can provide sufficient evidence for a fake prediction, so the final image-level prediction is driven by localized artifact evidence rather than a holistic image representation. However, since instances within the same bag are derived from the same image and share the same image-level label, the model may learn image-level shortcuts instead of truly identifying localized generative artifacts. To address this issue, we introduce Cross-Shuffle, which recomposes fake bags by mixing features from real images at both the tile and patch levels. This strategy breaks shortcut correlations among instances and forces the falsification-driven classifier to focus on genuine artifact evidence.

As shown in Figure 1(c), FATAS first divides the input image into multiple tiles and predicts a fake score for each tile using an existing detector. It then aggregates tile-level predictions by emphasizing the most suspicious local regions. This design follows the falsification rule: once any tile exhibits strong generative artifacts, the whole image should be classified as fake, thereby preventing local fake evidence from being diluted by holistic modeling. Without retraining or architecture modification, FATAS substantially improves existing detectors, boosting the accuracy of CNNSpot [39] by over 20 percentage points on Midjourney and that of AIDE [41] by nearly 10 percentage points on Chameleon [41].

Our contributions are summarized as follows:

• We introduce the falsification-inspired principle, under which a single fake region can falsify an image, whereas a real image requires all regions to be authentic. We instantiate this principle as LTF, a hierarchical multiple-instance learning framework that explicitly learns localized discriminative artifacts. LTF incorporates Cross-Shuffle to create diverse instance combinations and improve model generalization.

• We introduce FATAS, a Falsification-driven Test-time Aggregation Strategy that requires no retraining and can be readily integrated into existing detectors at inference time. Despite its simplicity, it consistently improves detection performance in high-resolution scenarios.

• Extensive experiments on multiple cross-dataset benchmarks demonstrate that our method achieves state-of-the-art performance, with particularly strong gains on high-resolution datasets, validating both the effectiveness of the framework and its generalization capability.

Related Work

The increasing realism and diversity of AI-generated images have made it more difficult to develop detectors that are both reliable and generalizable across different synthesis techniques [32, 33, 36, 39, 40]. Existing research on AI-generated image detection is commonly divided into two main directions: low-level artifact modeling and high-level semantic modeling.

Low-level approaches focus on subtle statistical irregularities introduced by generative processes [4, 36, 37, 39, 40, 45, 49], based on the assumption that synthetic images contain traces absent from authentic photographs. For example, CNNSpot [39] improves cross-generator generalization through extensive data augmentation. LGrad [37] exploits gradient-based cues, while DIRE [40] measures diffusion reconstruction errors, a direction later extended by FIRE [4] through frequency-domain guidance. NPR [36] models abnormal pixel dependencies via local neighborhood analysis, MLEP [45] extends this line of work with multi-granularity and entropy-based features, and SLC [11] focuses on differences in color distributions. By learning transformed representations $f(x)$, these methods extract robust forensic signatures beyond raw RGB values. Breaking [49] further shows that suppressing semantic information can improve cross-distribution generalization, underscoring the value of simple statistical cues.

High-level approaches instead leverage pretrained visual representations to assess semantic plausibility and global visual consistency [2, 15, 17, 18, 25, 32, 34, 47]. UnivFD [25], for instance, adopts CLIP-ViT as its feature backbone to improve cross-generator robustness. Building on this paradigm, subsequent studies extend CLIP in different directions: FatFormer [19] augments it with frequency-aware adapters, C2P-CLIP [34] adapts it through image-text finetuning, and DRCT [2] improves global feature representations via hard-negative contrastive learning. Despite their differences in feature construction, both low-level and high-level methods still primarily derive image-level predictions from globally aggregated evidence, making it difficult to explicitly capture localized cues.

This issue becomes particularly acute in high-resolution regimes, where the cost of resizing and cropping is amplified: downscaling a high-resolution image to a fixed resolution compresses fine-grained details more aggressively, while a fixed-size crop covers an increasingly small portion of the scene. Existing detection methods for high-resolution AI-generated images (AIGI) generally follow one of three paradigms: resizing the entire image to a fixed resolution, analyzing a single local crop, or processing multiple patches followed by feature aggregation. Representative approaches in the first category include NPR [36] and UnivFD [25]. DRCT [2] and SAFE [14] instead adopt crop-based analysis, while more recent methods such as SPAI [12] and HiDA-Net [23] improve image coverage through multi-patch processing. Although these strategies partially mitigate the difficulty of handling high-resolution inputs, they primarily emphasize broader image coverage. The effective modeling and aggregation of local discriminative evidence remain insufficiently explored.

Method

As shown in Figure 2, we propose Learning to Falsify (LTF), a hierarchical detection framework designed to preserve full spatial coverage and identify localized artifacts that can falsify an image’s authenticity. Given an input image, LTF first uses a frozen CLIP-ViT to construct hierarchical tile- and patch-level bags, enabling the model to represent both coarse regional context and fine-grained local details. To encourage the model to focus on local synthetic artifacts rather than image-level shortcuts, Cross-Shuffle recomposes instances across bags during training. The resulting bags are then processed by falsification-driven MIL heads, which is used to identify and aggregate discriminative local evidence. Finally, predictions from the tile and patch levels are fused and jointly optimized with multi-level supervision.

Vector (PDF)

Hierarchical Image Representation

Instead of resizing the whole image or using only one crop, we keep the input image at its original resolution and represent it into hierarchical tile-level and patch-level features. Specifically, given an input image, we first partition it into $N$ non-overlapping tiles of size 224 × 224, and then use a frozen CLIP-ViT backbone to encode each tile independently. For the $i$-th tile, the encoder outputs one CLS token $c_i$ and $M$ patch tokens $\{p_{i,j}\}_{j=1}^{M}$. The CLS token summarizes the overall content of the tile, while the patch tokens describe smaller local regions within the tile and retain fine-grained artifact cues.

Following the multiple instance learning (MIL) paradigm, we treat each token as an instance and organize these instances into hierarchical bags. For each image, all CLS tokens from the $N$ tiles are grouped into one tile-level bag, which captures coarse regional patterns. Meanwhile, the $M$ patch tokens within each tile form a separate patch-level bag, preserving fine-grained local patterns inside that tile. Formally, these bags are defined as:

Thus, an image partitioned into $N$ tiles is represented by one tile-level bag and $N$ patch-level bags. In the example shown in Figure 2, $N = 4$, the image is represented as one tile-level bag and four patch-level bags.

Cross-Shuffle

Given the hierarchical bags constructed above, directly applying standard MIL optimization is still suboptimal. Since all instances in a bag inherit the same image-level label, the model may treat the bag as a globally labeled sample and memorize image-level semantic shortcuts, rather than learning which local instances contain discriminative generative artifacts. To overcome this, we propose Cross-Shuffle, which dynamically recomposes bags across images during training, as illustrated in Figure 2(b). The key idea is to create more diverse instance compositions while keeping the bag label strictly valid under the falsification principle: a real bag should only contain authentic instances, whereas a fake bag remains fake as long as at least one fake instance is preserved.

At each hierarchical level, we construct a real pool and a fake pool within each mini-batch by collecting instances from real and fake images, respectively. Given a replacement ratio $\rho\in[0,1)$, Cross-Shuffle randomly selects $\lfloor\rho K \rfloor$ positions in each bag for replacement. For a real bag, the selected instances are replaced only with instances from the real pool, ensuring that the recomposed bag remains fully authentic. For a fake bag, the selected instances are replaced with instances sampled from either the real or fake pool. Since $\rho< 1$, at least one original instance from the source fake bag is preserved, so the recomposed fake bag remains label-consistent under the falsification principle. In this way, Cross-Shuffle breaks the shortcut correlations among instances from the same image while preserving valid bag labels.

Falsification-Driven MIL Aggregation

Given the recomposed bags from Cross-Shuffle, the remaining challenge is to infer the bag label from a set of instance features. Guided by the falsification-inspired principle, synthetic evidence in a fake bag is often highly localized, meaning uniform instance weighting easily dilutes these subtle cues among predominant authentic features. Therefore, an effective MIL aggregator must selectively identify decisive instances and magnify their contributions to the bag-level decision.

To this end, we introduce Falsification-Driven MIL Aggregation. As illustrated in Figure 2, we adopt a gated-attention MIL head [10] to process the contextualized instance features produced after Cross-Shuffle and Transformer encoding. The MIL head computes an importance score for each instance and normalizes these scores into attention weights. These weights are then used to aggregate both instance features and instance-level classification logits, producing a bag-level representation and bag-level logits, respectively. The resulting outputs are used for subsequent dual-branch fusion.

Specifically, given a recomposed bag $\widetilde{\mathcal{B}}$, a Transformer block first encodes its instances and produces a contextualized feature $\mathbf{h}_j \in\mathbb{R}^{d}$ for each instance $j \in\{1,\ldots,K\}$. The gated-attention module [10] then estimates the importance of each instance by computing an attention score $s_j$ as follows:

where $\tanh(\cdot)$ and $\sigma(\cdot)$ denote element-wise hyperbolic tangent and sigmoid functions, respectively, $\odot$ denotes element-wise multiplication, and $\mathbf{V},\mathbf{U} \in\mathbb{R}^{L \times d}$, $\mathbf{w} \in\mathbb{R}^{L}$ are learnable parameters with hidden dimension $L$. The attention scores are normalized across all $K$ instances using softmax:

The resulting weight $a_j$ measures the relative contribution of the $j$-th instance to the bag-level prediction. Therefore, instances assigned higher attention scores contribute more strongly during aggregation. Under the falsification-inspired principle, this weighting mechanism allows localized synthetic evidence to dominate the bag-level decision.

While the attention weights identify which instances are important, the MIL head also needs to determine what each important instance supports, i.e., real or fake. Therefore, we attach a lightweight linear classifier to each contextualized instance feature $\mathbf{h}_j$ to produce instance-level binary classification logits $\ell_j$. These logits provide explicit local authenticity evidence, while the attention weights determine how strongly each instance should contribute to the bag-level decision. The bag-level embedding $\mathbf{h}_{\mathrm{bag}}$ and bag-level logits $\ell_{\mathrm{bag}}$ are then computed by weighted aggregation:

The bag-level logits produced at each hierarchical level are supervised by the image-level label using cross-entropy loss, and the resulting losses are summed as $\mathcal{L}_{\mathrm{bag}}$. This objective encourages the instance classifier and attention weights to jointly discover discriminative local artifacts, while providing reliable intermediate prediction signals for final prediction.

Hierarchical Classifiers

The MIL heads produce hierarchical artifact evidence at two levels. At the tile level, the MIL head aggregates all tile instances into a tile-level image representation $\mathbf{h}_{\mathrm{tile}}$. At the patch level, the MIL heads produce $N$ patch-bag representations, each corresponding to one tile. We additionally introduce a patch-level aggregator with a learnable query token to summarize these $N$ representations into a unified patch-level image representation $\mathbf{h}_{\mathrm{patch}}$.

After obtaining the tile-level and patch-level image representations, we attach a classifier to each branch to make both levels directly discriminative. The tile-level classifier operates on $\mathbf{h}_{\mathrm{tile}}$ and captures coarse regional artifact evidence, while the patch-level classifier operates on $\mathbf{h}_{\mathrm{patch}}$ and focuses on fine-grained local artifacts.

Since the reliability of tile-level and patch-level evidence may vary across images, we further adopt an adaptive fusion strategy. Specifically, a lightweight gating network takes the two branch logits as input and predicts a sample-adaptive fusion weight $\alpha\in(0, 1)$, which indicates the relative contribution of the patch-level branch. The fused representation is then computed as

Finally, $\mathbf{h}_{\mathrm{fuse}}$ is fed into a linear classifier to produce the image-level real/fake prediction.

The three classifiers are supervised by the image-level label, yielding the patch-level loss $\mathcal{L}_{p}$, tile-level loss $\mathcal{L}_{t}$, and fusion loss $\mathcal{L}_{f}$. The overall hierarchical classification objective is

All classification objectives are implemented using binary cross-entropy loss.

Model Training and Inference

The model is optimized with two complementary objectives. The bag-level loss $\mathcal{L}_{\mathrm{bag}}$ directly supervises the intermediate MIL logits to strengthen localized artifact learning while the hierarchical classification loss $\mathcal{L}_{\mathrm{cls}}$ supervises the patch-level, tile-level, and fused image-level predictions defined above. The total training objective is defined as

where the two losses are assigned equal weights.

After the model is trained, the output of the fusion classifier is used as the final real/fake prediction. It is worth noting that Cross-Shuffle is disabled during inference.

Falsification-Driven Test-Time Aggregation Strategy

Building on the falsification-driven principle, we further explore whether existing detectors can be adapted to high-resolution AIGI detection at test time without retraining. Standard resizing or single-crop inference may suppress or omit local artifacts in high-resolution images. To address this issue, we propose a Falsification-Driven Test-Time Aggregation Strategy (FATAS), which preserves full spatial coverage and allows highly suspicious local regions to directly influence the image-level prediction. FATAS is plug-and-play and can be applied to off-the-shelf detectors without architectural modifications or re-training.

Specifically, given a high-resolution image, FATAS partitions it into $N$ non-overlapping tiles with full spatial coverage. An off-the-shelf detector then evaluates each tile $T_i$ independently and predicts a synthetic probability $p_i$. Instead of averaging all tile scores, which may dilute fake evidence, FATAS follows the falsification principle and aggregates the most suspicious tiles. The final image-level prediction is computed by averaging the top-$k$ tile probabilities:

where $\operatorname{Top-}k(\cdot)$ selects the $k$ highest probabilities among all $N$ tiles, $\operatorname{Mean}(\cdot)$ denotes the average operation.

By focusing on the most suspicious local regions while retaining full image coverage, FATAS reduces the risk of missing local artifacts in high-resolution inputs. It therefore extends the falsification-driven principle to test-time aggregation and provides a training-free strategy for improving existing detectors in high-resolution scenarios.

Experiments

Setting

Datasets. We conduct experiments on four benchmarks: GenImage [51], DRCT [2], Chameleon [41], and HiRes-50K [23]. GenImage and DRCT are widely used benchmarks for evaluating the cross-dataset generalization ability of AIGI detectors, containing 8 and 16 test subsets, respectively. Chameleon provides a more realistic and challenging evaluation setting for high-resolution AIGI detection, comprising 26,033 samples with resolutions ranging from 0.5K to 4K. HiRes-50K is a dedicated benchmark for high-resolution AI-generated image detection across different resolution ranges. We compare our method with prior approaches on all four benchmarks.

Metrics. We adopt Accuracy (Acc) and Average Precision (AP) for evaluation, consistent with prior studies [2, 44, 51]. A fixed threshold of 0.5 is used for binary classification decisions. For conciseness, we report Acc in the main paper and provide the corresponding AP results in the supplementary material.

Implementation Details. All experiments are conducted using a pretrained CLIP ViT-L/14 visual backbone, whose parameters remain frozen throughout training. The model is trained for 20 epochs using AdamW with a weight decay of 0.05 and a per-GPU batch size of 64. The main experiments are conducted on four NVIDIA A100 GPUs, each with 80 GB of memory, resulting in a global batch size of 256. The learning rate is set to $4 \times10^{-4}$ with a constant schedule. For data augmentation, we apply only JPEG compression and Gaussian blur. Additional implementation settings are provided in the supplementary material.

Comparison with State-of-the-Art Methods

Generalization on GenImage and DRCT. To comprehensively assess the generalization of LTF across diverse generative models and data distributions, we conduct evaluations on the GenImage and DRCT benchmarks. Table 1 summarizes the performance comparison on GenImage, where all methods are trained on SD v1.4 subset. Our proposed LTF achieves the best performance, outperforming recent strong baselines such as PPL (97.2%), C2P-CLIP (95.8%), and SAFE (95.6%). Moreover, LTF achieves the second-lowest standard deviation while substantially outperforming the method with the lowest standard deviation, demonstrating a better balance between performance and stability. Notably, the Midjourney subset contains the highest-resolution images in the GenImage benchmark, and LTF achieves the best accuracy on this subset as well, reaching 97.3%, which further reflects its advantage in handling higher-resolution generated images.

Method	Venue	Midjourney	SDv1.4	SDv1.5	ADM	GLIDE	Wukong	VQDM	BigGAN	mAcc	std
ResNet-50 [8]	CVPR2016	54.9	99.9	99.7	53.5	61.9	98.2	56.6	52.0	72.1	22.6
DeiT-S [38]	ICML2021	55.6	99.9	99.8	49.8	58.1	98.9	56.9	53.5	71.6	23.2
Swin-T [20]	ICCV2021	62.1	99.9	99.8	49.8	67.6	99.1	62.3	57.6	74.8	21.1
CNNSpot [39]	CVPR2020	52.8	96.3	95.9	50.1	39.8	78.6	53.4	46.8	64.2	22.6
Spec [48]	WIFS2019	52.0	99.4	99.2	49.7	49.8	94.8	55.6	49.8	68.8	24.1
F3Net [27]	ECCV2020	50.1	99.9	99.9	49.9	50.0	99.9	49.9	49.9	68.7	25.8
GramNet [22]	CVPR2020	54.2	99.2	99.1	50.3	54.6	98.9	50.8	51.7	69.9	24.2
UnivFD [25]	CVPR2023	93.9	96.4	96.2	71.9	85.4	94.3	81.6	90.5	88.8	8.6
NPR [36]	CVPR2024	81.0	98.2	97.9	76.9	89.8	96.9	84.1	84.2	88.6	8.3
FreqNet [35]	AAAI2024	89.6	98.8	98.6	66.8	86.5	97.3	75.8	81.4	86.8	11.6
FatFormer [19]	CVPR2024	92.7	100.0	99.9	75.9	88.0	99.9	98.8	55.8	88.9	15.7
DRCT [2]	ICML2024	91.5	95.0	94.4	79.4	89.1	94.6	90.0	81.6	89.4	5.9
Breaking [49]	NeurIPS2024	83.9	98.9	93.0	99.1	97.7	85.4	92.7	90.5	92.7	5.8
AIDE [41]	ICLR2025	79.4	99.7	99.8	78.5	91.8	98.7	80.3	66.9	86.9	12.3
VIB [46]	CVPR2025	88.1	99.6	99.6	73.9	74.3	98.3	89.4	91.2	89.3	10.4
Beyond [50]	CVPR2025	95.0	95.3	95.5	95.3	95.2	95.6	95.1	95.2	95.3	0.2
Effort [42]	ICML2025	82.4	99.8	99.8	78.7	93.3	97.4	91.7	77.6	90.1	11.8
SAFE [14]	KDD2025	95.3	99.4	99.3	82.1	96.3	98.2	96.3	97.8	95.6	5.6
C2P-CLIP [34]	AAAI2025	88.2	90.9	97.9	96.4	99.0	98.8	96.5	98.7	95.8	4.0
HSIC [43]	ICLR2026	80.8	99.9	99.8	91.1	97.0	99.8	99.4	91.7	95.0	6.8
PPL [44]	ICLR2026	94.8	98.5	98.3	94.7	96.1	98.6	98.5	98.0	97.2	1.7
LTF	This work	97.3	98.9	98.6	98.4	98.1	98.9	98.7	98.1	98.4	0.5

Additionally, we conduct an experiment on DRCT, where all methods are trained on the SD v1.4 subset of DRCT-2M [2]. As shown in Table 2, LTF achieves the highest mean accuracy of 98.62%, outperforming DRCT (91.35%) and Beyond (90.86%). These results demonstrate that LTF generalizes effectively across different data distributions.

Method	LDM	SDv1.4	SDv1.5	SDv2	SDXL	SDXL-Refiner	SD-Turbo	SDXL-Turbo	LCM-SDv1.5	LCM-SDXL	SDv1-Ctrl	SDv2-Ctrl	SDXL-Ctrl	SDv1-DR	SDv2-DR	SDXL-DR	mAcc	std
CNNSpot [39]	99.87	99.91	99.90	97.55	66.25	86.55	86.15	72.42	98.26	61.72	97.96	85.89	82.84	60.93	51.41	50.28	81.12	17.6
F3Net [27]	99.85	99.78	99.79	88.66	55.85	87.37	68.29	63.66	97.39	54.98	97.98	72.39	81.99	65.42	50.39	50.27	77.13	18.1
CLIP/RN50 [28]	99.00	99.99	99.96	94.61	62.08	91.43	83.57	64.40	98.97	57.43	99.74	80.69	82.03	65.83	50.67	50.47	80.05	18.3
GramNet [22]	99.40	99.01	98.84	95.30	62.63	80.68	71.19	69.32	93.05	57.02	99.97	75.55	82.68	51.23	50.01	50.08	76.62	17.0
De-fake [31]	92.10	99.53	99.51	89.65	64.02	69.24	92.00	93.93	99.13	70.89	58.98	62.34	66.66	50.12	50.16	50.00	75.52	18.4
Conv-B [21]	99.97	100.00	99.97	95.84	64.44	82.00	80.82	60.75	99.27	62.33	99.80	83.40	73.28	61.65	51.79	50.41	79.11	18.3
UnivFD [25]	98.30	96.22	96.33	93.83	91.01	93.91	86.38	85.92	90.44	88.99	90.41	81.06	89.06	51.96	51.03	50.46	83.46	17.0
DRCT [2]	94.45	94.35	94.24	95.05	95.61	95.38	94.81	94.48	91.66	95.54	93.86	93.48	93.54	84.34	83.20	67.61	91.35	7.11
Beyond [50]	97.13	97.13	97.13	97.13	97.13	97.13	97.13	97.13	97.13	97.13	97.08	96.81	94.73	92.26	51.79	97.79	90.86	15.7
LTF	99.68	99.70	99.70	99.70	99.70	99.65	99.65	99.68	99.69	99.70	99.69	99.68	99.67	99.70	98.00	82.80	98.62	4.08

Vector (PDF)

Performance on high-resolution datasets. In this experiment, we investigate the effectiveness of LTF in detecting high-resolution generated images. We first conduct an evaluation on the Chameleon dataset. As shown in Figure 3, LTF achieves an accuracy of 72.94%, outperforming the second-best method by a substantial margin. We further evaluate on HiRes-50K [23] to examine whether its advantage remains consistent under different image resolutions. As reported in Table 3, LTF achieves the highest average accuracy of 81.43% and ranks first across all resolution ranges. More importantly, its performance advantage becomes more pronounced on higher-resolution images, especially in resolution ranges spanning 1,500–5,000 pixels. Overall, these results demonstrate the effectiveness of LTF for detecting high-resolution AI-generated images.

Resolution Range	0–900	900–1200	1200–1500	1500–2000	2000–2500	2500–3000	3000–5000	[5000, ∞)	Avg.
CNNSpot	58.46	56.37	58.73	63.14	67.42	60.90	66.30	58.90	61.28
FreDetect	63.67	55.63	57.31	58.90	58.16	67.78	57.23	51.06	58.72
UnivFD	67.00	58.35	62.20	65.95	66.05	58.20	58.15	60.05	61.99
DIRE	59.11	64.25	62.10	66.66	75.84	63.40	69.31	62.18	65.36
AIDE	65.87	57.29	49.90	58.23	51.88	65.31	61.04	42.16	56.46
DRCT(ConvB)	65.30	66.19	68.78	68.85	68.78	75.79	69.65	54.03	67.17
TextureCrop(CNNDetect)	57.45	52.81	59.83	63.17	65.31	55.56	70.65	69.49	61.78
HiDA*	73.05	69.20	70.21	68.82	76.73	62.00	58.40	69.84	68.53
LTF	75.89	76.55	74.30	86.15	91.69	86.60	81.90	78.39	81.43

Vector (PDF)

Experimental Evaluation of FATAS

We further evaluate the effectiveness of our Falsification-Driven Test-Time Aggregation Strategy (FATAS) on two high-resolution benchmarks, Chameleon and Midjourney. FATAS is applied in a training-free manner to five representative detectors, including NPR [36], AIDE [41], CNNSpot [39], DIRE [40], and Effort [42], using their official pre-trained checkpoints.

Fig. 4 shows that FATAS improves the majority of the evaluated detectors over their base results on both datasets. The gains are particularly significant on Midjourney, where all five detectors achieve higher accuracy when $K \ge2$. On Chameleon, substantial improvements are observed for AIDE and Effort, while CNNSpot also benefits consistently from multi-patch inference. Notably, these gains are achieved across detectors with substantially different base accuracies, demonstrating the broad applicability of FATAS. Performance generally becomes stable as more patches are included, indicating that a small number of informative patches is sufficient to improve prediction. A more comprehensive evaluation and detailed analysis are provided in the supplementary material.

Ablation Study

We conduct two ablation studies on GenImage to evaluate the key designs of LTF. Unless otherwise specified, models are trained on the SD v1.4 subset and evaluated on the full test set.

Effect of Cross-Shuffle and MIL Head. To evaluate the individual contributions of Cross-Shuffle and the MIL Head, we conduct component ablations on GenImage. As shown in Table 4, employing the MIL Head alone leads to a noticeable performance drop in overall accuracy, primarily due to misclassifications on fake images.

Model	mAcc	Real Acc	Fake Acc	AUC	AP
Baseline	91.86	97.17	86.55	98.22	98.17
+ MIL Head	87.93	99.89	75.97	99.51	99.48
+ Cross Shuffle	96.41	98.77	94.06	99.63	99.62
Full LTF	98.40	97.68	99.09	99.89	99.86

In contrast, applying Cross-Shuffle alone substantially boosts detection accuracy, while combining both components yields the highest overall accuracy. These results demonstrate that the MIL Head relies on the diverse instance compositions provided by Cross-Shuffle to effectively capture and aggregate localized synthetic artifacts. Notably, full LTF achieves a substantial gain in fake-class accuracy over the baseline, providing strong empirical evidence for the principle of Learning to Falsify.

Effect of Hierarchical Image Representation. To validate our hierarchical modeling, we compare the tile-level branch, patch-level branch, and their hierarchical fusion. As shown in Table 5, hierarchical fusion achieves the best overall performance with an accuracy of 98.40%, outperforming both individual branches and demonstrating their complementary nature for AIGI detection. Although the patch-level branch attains high accuracy on fake images, it suffers from a noticeably lower accuracy on real images, exhibiting a higher false-positive rate. By incorporating the tile-level representation, hierarchical fusion effectively restores performance on real images while maintaining strong fake-image detection, achieving a superior balance across both classes.

Branch	mAcc	Real Acc	Fake Acc	AUC	AP
Tile level	95.26	92.41	98.12	99.36	99.34
Patch level	97.39	95.24	99.55	99.88	99.86
Hierarchy	98.40	97.68	99.09	99.89	99.86

Robustness Analysis

To evaluate robustness to common image degradations, we compare our method with UnivFD and DRCT on GenImage under three types of image transformations: JPEG compression, Gaussian blur, and image rescaling. As shown in Figure 5, our method demonstrates stronger robustness than UnivFD and DRCT across these degradation settings. Under JPEG compression, it outperforms both baselines by approximately 13 percentage points at a quality factor of 60. Under Gaussian blur, our method consistently achieves the highest accuracy, outperforming UnivFD and DRCT by 10–18 percentage points under severe blur ($\sigma= 2.5$). Although its performance is less competitive under downscaling, where fine-grained details are lost, our method achieves the highest accuracy among the compared methods when the scale factor exceeds 1.0.

Vector (PDF)

Computational Efficiency

We evaluate computational efficiency on the same machine under identical settings. For a fair comparison, all multi-patch methods are standardized to a fixed budget of 10 patches per image. As shown in Table 6, single-patch methods are faster but less accurate, whereas existing multi-patch approaches trade high computational overhead for accuracy gains. In contrast, LTF achieves a superior balance between computational efficiency and detection performance.

Method	FLOPs (G) ↓	Latency (ms) ↓	Memory (MB) ↓	Params (M) ↓	Accuracy (%) ↑
Single-patch methods
UnivFD	77.83	10.60	1699	427.6	61.99
DRCT	77.83	10.60	1664	428.4	67.17
AIDE	225.70	32.90	3425	897.8	56.46
Multi-patch methods
SPAI	658.00	233.00	4376	139.95	69.92
HiDA	821.16	64.26	1714	403.0	68.53
LTF	779.54	57.17	1395	319.5	81.43

Conclusion

In this work, we introduced Learning to Falsify as a general principle for AI-generated image detection. Based on this principle, we developed LTF, a hierarchical MIL framework that learns discriminative representations across multiple levels. Cross-Shuffle is a key component of LTF, as it creates diverse instance compositions that enable the MIL Head to better capture localized artifacts. We also proposed FATAS, a plug-and-play method that enhances existing detectors through multi-patch inference and falsification-driven aggregation. Extensive experiments on GenImage, DRCT, Chameleon, and HiRes-50K demonstrate the strong cross-dataset generalization of our approach, particularly on high-resolution images.

Despite its favorable accuracy-efficiency trade-off, our approach remains more computationally demanding than single-patch methods. Improving its efficiency is therefore an important direction for future research. Beyond image detection, we believe the Learning to Falsify principle can also be extended to AI-generated video detection, where we expect similar potential for improvement.

Acknowledgments

This work was supported by the National Natural Science Foundation of China (No. 62472385), NSFC (Joint Fund) Key Program (No. U25A20440), Pioneer and Leading Goose R&D Program of Zhejiang (No. 2024C01110), Fundamental Research Funds for the Provincial Universities of Zhejiang (No. FR2402ZD), Tongxiang Institute of Artificial General Intelligence (No. TAGI2-B-2024-0004), Zhejiang Provincial High-Level Talent Special Support Program (2022R52048), the Graduate Scientific Research and Innovation Fund of Zhejiang Gongshang University (No. ZDXM2025010), Zhejiang Provincial Science and Technology Innovation Program (New Young Talent Program) for College Students (No. 2025R408A008) and the Computing Power Resource of the Future Experiment Center of Zhejiang Gongshang University.

References