RGGID: A Robust and Green GAN-Fake Image Detector

We have witnessed the rapid development of image generation techniques based on convolutional neural networks (CNNs) in general and generative adversarial networks (GANs) [10] in particular. Various GANs have been developed to yield high quality image synthesis and translation performance. The quality of these generated images is so good that it is difficult to distinguish them from real images. This poses a threat to image authenticity and may contribute to a source of dis/misinformation in our society. Effective detection of GAN-fake images has received a lot of attention in recent years.

The challenges of GAN-fake image detection lie in two aspects. First, it is common to apply manipulations to real/fake images in real-world application scenarios. They include JPEG compression, resizing, Gaussian additive noise, etc. The distortions introduced by manipulations may mask small differences between real and fake images and make it even more difficult to perform fake image detection. Thus, it is essential to develop a robust GAN-fake image detector. Second, most state-of-the-art GAN-fake image detectors are built upon deep neural networks (DNNs). They offer good detection performance at the expense of large model sizes, a large number of training images, high training complexity, etc. When dealing with manipulated images, DNN classifiers adopt deeper networks and augment the training set by including all kinds of manipulated images, leading to even larger model sizes and higher training complexity. To address these two problems, we develop a robust and green GAN-fake image detector, named RGGID, in this work.

Our RGGID detector is designed based on the assumption that GANs fail to synthesize high-frequency components in local regions, such as edges and textures, in high fidelity. Following [24] and [20], we show real and fake horse images in the pixel- and the spectral-domains in Figure 1. As compared with the real spectral image, the fake spectral image contains artifacts in diagonal and anti-diagonal directions. This corroborates our assumption that GANs do not synthesize high-frequency components well. Here, we focus on complex local regions that have high-frequency components and employ a set of local filters, called filter banks or PixelHops, to extract features. We develop an ensemble scheme to ensure robust detection under different image manipulations. The RGGID solution outperforms DNN-based GAN-fake image detectors in detection performance. Furthermore, it has three additional advantages: 1) low computational and memory complexity (i.e., green), 2) robustness against image manipulations, and 3) mathematical transparency.

Our current work is an extension of our previous work in [25]. The method proposed in [25] was called A-PixelHop. It was developed and applied only to raw real/fake image detection. No image manipulations were considered in [25]. One of the main contributions of our current work lies in the study of robustness of RGGID against common image manipulations. Image ma-nipulations introduce additional artifacts to real/fake images. They tend to mask the differences between real/fake images and make the detection problem even more challenging. It is shown by experimental results that RGGID is robust against image manipulations. In addition, we conduct analysis on the experimental results to gain further insights. With respect to our previous work in [25], the main extensions of this work include the following.

• We explore the robustness of RGGID against three common image manipulations.

• We analyze the influence of image manipulations on different semantic categories.

• We propose a new experimental setting called “Leave-None-Out,” which is more reasonable, and improve detection performance on weak categories.

The rest of this paper is organized as follows. Related work is reviewed in Section 2. The RGGID method is presented in Section 3. Experimental results are shown in Section 4. The effect of image manipulations on different semantic categories is analyzed and a new experimental setting is presented in Section 5. Concluding remarks are given in Section 6.

Modern image generation models are built upon Generative Adversarial Networks (GANs). CycleGAN [11] is a well-known GAN model that can change the image style, switch semantic objects and translate images from one domain to a different domain without paired training images. GauGAN [19] can translate human sketches to photo-realistic images. One common application of style transfer models is face manipulation. For example, StarGAN [7] can change the expression of a face, alter hair style, or modify skin color. StyleGAN [13] generates fully synthetic human faces with specific high-level attributes such as poses or identities. ProGAN [12] synthesizes high-resolution high-variation face images by progressively growing both the generator and discriminator. BigGAN [1] aims at generating high-quality high-resolution images by leveraging a sequence of best practices on training class-conditional images and scaling up batch sizes.

GAN artifacts have been carefully studied and exploited in GAN-fake image detection. One type of artifact results from the convolutional up-sampling structure of neural networks. Another kind of artifact appears in the form of color distortion, which was used to capture the dissonant or asymmetric characteristics of images in Li et al. [17] and Matern et al. [15]. Another source of artifacts arises from the artificial fingerprint associated with a GAN architecture. The persistence of these fingerprints across different GAN models, datasets and resolutions was studied in Yu et al. [21]. A GAN simulator, called AutoGAN, was introduced in Zhang et al. [24] to simulate artifacts of popular GAN models. Zhang et al. [24] identified an artifact that manifests itself as spectral peaks in the frequency domain, and thus proposed feeding the spectral-domain input to a classifier for GAN-fake image detection.

Several neural networks have been proposed for GAN-fake image detection. Nataraj et al. [18] used the co-occurrence matrix to derive hand-crafted features and fed them to a CNN for detection. Inspired by image steganalysis, Cozzolino et al. [8] proposed a CNN to mimic rich models [9] in feature extraction and real/fake classification. Recently, Wang et al. [20] trained a CNN classifier with a large number of ProGAN-generated images and evaluated it on images synthesized by eleven other GAN models. They showed the effectiveness of extensive data augmentation in improving the generalization ability of a CNN classifier.

Most research on GAN-fake image detectors has been developed and tested on raw real/fake images. However, most real world images do not exist in the raw image domain. They are compressed for ease of storage and transmission. They may be rescaled to fit different screen sizes. Furthermore, an attacker may add Gaussian noise to real/fake images to make their differentiation more challenging. There is much less work on the robustness of GAN-fake image detectors against image manipulations. Marra et al. [16] compared the performance of multiple neural networks under Twitter’s compression. They also considered the compression setting mismatch between training and testing datasets to evaluate the robustness of CNN-based classifiers. Wang et al. [20] explored data augmentation to enhance the robustness of a detector.

Green learning aims at an energy efficient way to achieve the goal of data-driven learning. The models should have lower training/inference computational complexity, have smaller model sizes, and require fewer training samples while maintaining similar classification or regression performance as deep-learning models. It is desired that their computation can be carried out solely on CPU or small GPU. Thus, green learning solutions are suitable for edge and mobile computing.

Distinct from the end-to-end optimization of deep learning, green learning adopts a modularized design by following the traditional pattern recognition learning paradigm. It consists of “unsupervised feature learning” and “supervised decision learning.” The idea of unsupervised feature learning has been developed in a sequence of papers [5, 6, 14]. While filter parameters of CNNs are obtained by back-propagation, filter parameters in green learning are determined by statistical analysis of the neighborhood of a center pixel. Specifically, a variant of Principle Component Analysis (PCA), called the Saab (Subspace approximation via adjusted bias) transform was proposed in [14] to achieve the task.

Green learning has been successfully applied to various computer vision tasks such as image classification [5, 6] and 3D point classification [22, 23]. In the area of image forensics, green learning solutions or “green forensics,” have also been developed, such as deepfake video detection [2] and fake geo-spatial image detection [3] with specific image contents. The former focuses on human face videos while the latter examines satellite images. In this work, we investigate GAN-fake image detection for a wide range of semantic contents, including object images (e.g., apples, oranges, zebras, and horses), scene images (e.g., winter, summer, city, and facades), and paintings of different styles (Ukiyo-e, Van Gogh, Cezanne, and Monet).

An overview of the proposed RGGID method is given in Figure 2. It consists of the following four modules:

1. Spatial block selection. We select blocks that contain a substantial amount of high frequency components.

2. Feature extraction via parallel PixelHops. We conduct local spectral analysis by studying frequency responses of multiple sets of local filters. Each set of local filters is called a filter bank or a PixelHop.

3. Discriminant feature selection and block-level decision making. We use the validation dataset to identify discriminant channels and use their channel responses as features for the block-level soft decisions.

4. Image-level decision ensemble. We ensemble the block-level soft decisions to yield the final image-level binary decision.

Each of them will be detailed below.

Since our method is developed based on the assumption that GAN generators are not able to synthesize high-frequency components in high fidelity, we focus on spatial blocks that contain fine details. In the implementation, we partition images into non-overlapping blocks of size 16 × 16. Each block will be used as an independent unit for feature extraction, feature selection, and local decision making in the second and third modules. To select blocks containing fine details, the variance of image pixels in a block is computed. That is, we remove the block mean and sum the squares of pixel residuals. For each image, the top 40% blocks with the highest block variances are selected since they contain more energy of high frequency components. Figure 3 shows examples of selected blocks overlaid with the original images. It is evident that selected blocks are from high-frequency regions, such as the horse head and legs in the horse image, trees in the winter image, cars and buildings in the cityscape image, etc.

For a squared region of spatial dimension s × s and spectral dimension c, we can define a local neighborhood of dimension s × s × c. For example, we can set s = 2 and c =3 (due to the R, G, B channels of color images). Then, the neighbood has a dimension of 12 (i.e., 12 pixel values). We can consider different weighted sums of these 12 pixel values, which defines a set of filters. The set of filters is called a filter bank. One specific way to define the filter weights is described as follows.

• One DC filter, where all filter weights are set to the same value (i.e., a constant-value vector), and then the vector length is normalized to unity. This filter is called the DC filter and its response is called the DC response.

• Eleven AC filters, where the DC response is subtracted from all pixel values to yield the AC values, principal component analysis is conducted on a collection of neighborhoods, and the eigenvectors associated with non-zero eigenvalues define eleven AC filters.

A filter bank with its filter coefficients selected by this procedure is called a PixelHop. As shown in Figure 2, a PixelHop is used as a feature extraction unit. A PixelHop system is determined by 4 parameters:

1. Neighborhood size s₁ × s₂, where s₁ and s₂ denote the width and the height, respectively. Typically, we choose squared neighborhoods such that s₁ = s₂ = s;

2. Number of spectral components of a pixel, denoted by c;

3. The stride number, denoted by d, which indicates the amount of movement of the neighborhood horizontally or vertically.

In our design, we select three squared neighborhoods of sizes 2 × 2, 3 × 3, and 4 × 4. The spectral component number, c, is equal to 3, and the stride number, d, is one. We apply the three PixelHops to blocks of size 16 × 16 in parallel without padding. As a result, they have 12, 36 and 48 filter (or channel) responses at 15 × 15 = 225, 14 × 14 = 196, and 13 × 13 = 169 spatial locations, respectively. These responses are called joint spatial-spectral responses. We are interested in channel responses. That is, for a given filter, we collect and order its spatial responses to form a feature vector. For example, for the 2 × 2 × 3 PixelHop, we have 12 channel responses and each of them has a feature vector of dimension 225.

Different spectral channels have different discriminant power in real/fake image detection. As mentioned earlier, we use the responses at different spatial locations as the feature vector. Furthermore, we adopt a gradient boosting tree algorithm called XGBoost [4] as the classifier. To evaluate the discriminant power of a channel, we compare the classifier performance on training, validation and test datasets with the area-under-the-curve (AUC) and the accuracy (ACC) metrics. To give an example, we plot the performance curves of each channel for three semantic categories in the CycleGAN dataset [24] with two PixelHops in Figure 4. In this example, the images are raw real/fake images without any image manipulations. It is evident from the figure that some channels are more discriminant than others. Furthermore, the training, validation and testing datasets share the same discriminant channels. We select those channels with higher validation performance as target channels and train an XGBoost classifier for each channel. In the inference stage, we apply an XGBoost classifier to the spatial responses of the associated channel to obtain a soft decision ranging from 0 to 1, which indicates the probability of the block to be a real or fake image block.

Given block-level soft decisions from a single image in the third module, we develop an ensemble scheme to yield the final image-level decision in the last module. We first arrange the block-level soft decisions from smallest to largest in the unit interval, i.e., [0, 1]. The decision scores at the two ends are more informative than those in the middle range. Suppose that we plan to sample p% of blocks to train an ensemble classifier that will yield the image-level decision. Our sampling strategy is to choose 0.5p% soft decisions from the two ends of the distribution as shown in Figure 5, where selected representative soft decisions are denoted by red dots. Hyperparameter p represents the percentage of samples selected from the two tail regions of the distribution of soft decision scores. We set p = 10, 20, 30, 40, and choose the one that yields the best performance on the validation set.

We evaluated our model on the CycleGAN dataset in [24]. It has 14 semantic categories: Apple, Orange, Horse, Zebra, Yosemite summer, Yosemite winter, Facades, CityScape Photo, Satellite Image, Ukiyo-e, Van Gogh, Cezanne, Monet and Photo. According to the image translation content, the dataset contains 10 subsets where each subset contains both real and translated images. For example, the hor2zeb subset includes real horse and zebra images for training CycleGAN and corresponding fake horse and zebra images generated from the trained model. In total, there are over 36k images in the CycleGAN dataset.

We conducted experiments using the Leave-One-Out setting, as was done in [24] and [20]. Namely, one semantic category will be set aside for testing and the remaining semantic categories will be used for training and validation. We use the ratio of 8:2 to split the data from the remaining nine categories into training and validation sets. In this case, our proposed method is not restricted to a specific semantic category and can generalize well to all CycleGAN images. We tested our model under 3 different image manipulation techniques: JPEG compression, image resizing and additive noise. For each type of manipulation, both the training and testing images will be processed with the same manipulation setting to avoid mismatch. First, we discuss the detection on raw image data as reference. Then, we examine the scenarios in which the various manipulations are applied. We noticed that there exists a few categories that are relatively sensitive to manipulations. In Section 5, we analyze the effect of manipulations on sensitive categories and demonstrate that, by including a small amount of images from the sensitive categories in the training stage, our RGGID method is robust to image manipulations for all semantic categories in the CycleGAN dataset.

Table 1 shows the test detection results on the raw CycleGAN dataset with only 10% training data. By 10% training data, we mean 10% of training images from each category while keeping the validation and test sets unchanged. The results show that RGGID can perform well even under extremely weak supervision, which is discussed in more detail in Section 5.3. We compare the proposed RGGID method with six state-of-the-art models. The highest performance we obtained is 99.0% test accuracy acquired from the fusion of 12 channels, in which we select the 4 best channels from each of the three filter banks (i.e., the 2 × 2 × 3, 3 × 3 × 3, and 4 × 4 × 3 filter banks). The second best is 98.8% from 9 channel fusion, in which we select the 3 best channels from each filter bank. The 6 channel fusion result is the same as the one presented in [25]. This is the case where we achieve equally good performance but with the smallest model size. This indicates that our PixelHop solution is very powerful even if only a few channels are selected in the ensemble process.

To assess the robustness of RGGID under realistic scenarios, we run experiments in which images are compressed using different quality factors. JPEG compression creates distortions such as blocking and ringing artifacts that interfere with the up-sampling artifact originating from generative models. We verified the assumption that high-frequency responses are more distinguishable than other frequencies for the raw data. However, when applying JPEG compression, the high-frequency components of real compressed images are severely distorted as well. As a result, the difference between real and fake images is less discernible. Figure 6 shows the soft classification performance for each spectral channel on compressed images with quality factor 85. We see that discriminant channels are shifted from high-frequency bands to mid-and-low frequency bands.

We chose three commonly-used quality factors, i.e., 75, 85, and 95, in the experiments. Table 2 shows the test accuracy of RGGID for JPEG compressed images. For each quality factor, we show results for individual filter banks as well as for ensemble settings. Results for individual filter banks are marked as 2 × 2 × 3 only, 3 × 3 × 3 only, and 4 × 4 × 3 only. Results for ensemble schemes are marked as ensemble. For example, ensemble (2&3) means that we use only discriminant channels from the 2 × 2 × 3 and 3 × 3 × 3 filter banks. On the other hand, ensemble (all) is the case where we use discriminant channels from all filter banks. For each quality factor, we use bold to mark the setting with highest average test accuracy, and underline for the setting with the second highest accuracy. Generally speaking, 2 × 2 × 3 only tends to have better performance than other settings. This could be attributed to the 8 × 8 block DCT transform used in JPEG. Also, the 2 × 2 × 3 filter bank is more favorable than the 4 × 4 × 3 filter bank. This is because we select the same number of channels from each filter bank. Feature maps of selected channels in the 2 × 2 × 3 filter bank are more informative. This also explains the reason why ensemble schemes do not always give the best result. Also, we see that the accuracies for the ap2or and map2sat categories are significantly lower than other categories, which will be analyzed in Section 6.

Furthermore, we compare RGGID with other state-of-the-art methods in Table 3. Here, we present results from 8 other state-of-the-art methods whose performance scores are taken from [16]. In Table 3, the first 5 models are relatively shallow networks while the last three (DenseNet, InceptionNet, and XceptionNet) are deeper neural networks. Their performance scores are based on Twitter-like compression as explained in [16]. However, their compression quality factor is not explicitly provided. For fair comparison, we average our best result for each quality factor and present it in the last row of Table 3. In terms of the average test accuracy across all semantic categories, RGGID is very close to the two best models, DenseNet and XceptionNet, with only a 0.06% and 0.58% performance gap, respectively. Although XceptionNet is able to achieve marginally better performance in this particular experiment, it is important to point out that XceptionNet is a very deep neural network with more than 22.9M trainable parameters, while RGGID has only 76.2K trainable parameters.

Another common image manipulation is resizing. We focus on the scenario of resizing to lower spatial resolutions, referred to as down-sizing. Since the down-sizing operation interacts with artifacts arising from up-sampling in generative models and the differences between real and fake images becomes obscure, down-sized fake images are more challenging to detect.

There is little work on detecting resized real/fake images. Zhang et al. [24] chose 4 image sizes and randomly selected one as the target size. They trained a neural network with CycleGAN and Auto-GAN horse images, and tested it on other categories. Here, we consider 2 resizing factors (0.5 and 0.75) and conduct experiments under the “Leave-One-Out” setting for all categories.

Table 4 shows the results for individual filter banks as well as for ensemble settings. The proposed RGGID method can achieve a maximum accuracy of 95.45% and 92.84% for resize factors of 0.75 and 0.5, respectively. As compared with the 99% detection accuracy on raw images in Table 1, the accuracy degrades by 3.55% and 6.16% for resize factors of 0.75 and 0.5, respectively. Thus, RGGID is robust with respect to image resizing.

For a resize factor of 0.75, the 3 × 3 × 3 filter bank yields the best performance while the ensemble of the 3 × 3 × 3 and 2 × 2 × 3 filter banks yields the second best performance. For a resize factor of 0.5, individual filter banks are less effective, and the ensemble of all three filter banks gives the best performance.

The third image manipulation tested is additive Gaussian noise. Although it may not be as common as JPEG compression and image resizing in social media, Gaussian noise could be used to cover up certain weaknesses in synthesized images. It is essential to demonstrate the robustness of RGGID against additive Gaussian noise. In our experiments, we normalize the pixel values of the raw image to [0, 1] and use Gaussian noise with two noise levels (namely, σ = 0.01 and 0.02) to simulate a realistic scenario in forensics. Because additive noise introduces additional high-frequency information to the raw image, the source differences between real and fake images in high-frequency regions are diminished. This phenomenon is observed in the soft classification performance shown in Figure 7, where σ = 0.01. Similar to Figure 6, we see that high-frequency channels are not as discriminant as those in the raw image dataset. Discriminant channels are shifted from high-frequency to mid-frequency bands.

Table 5 shows the test accuracy for each semantic category under different noise levels. When σ = 0.01, RGGID can achieve a maximum average accuracy of 89.89%, which is approximately a 10% drop as compared to the accuracy for the raw image dataset. When the noise level is increased to σ = 0. 02, noise in the smooth regions is visible to human eyes, and detection of fake images becomes more challenging. In this case, the maximum average accuracy of RGGID is 86.52% using the 3 × 3 × 3 filter bank. Overall, RGGID can maintain good detection performance against additive Gaussian noise.

For each of the three aforementioned image manipulations, there are certain categories for which the performance is significantly lower as compared to the remaining categories. They are referred to as challenging categories. They are ap2or and map2sat for JPEG compression, citysc for image resizing, and ap2or, citysc and map2sat for additive Gaussian noise. We first analyze the effect of image manipulations in Section 5.1. Next, we propose a new experimental setting called Leave-None-Out in Section 5.2. We conduct extensive experiments under the new setting and show that the performance for the challenging categories can be increased significantly.

For JPEG compression, the two challenging categories are ap2or and map2sat. Figure 8 shows examples of original images, the corresponding JPEG compressed images, difference maps between the original and compressed images, and the spectra for both images. As revealed by the difference maps, we observe stronger distortion on the ap2or and map2sat images caused by JPEG compression as compared with hor2zeb and Ukiyoe images, which are considered easy categories. Furthermore, stronger high-frequency components of original images in the ap2or and map2sat categories are also revealed by their spectra (see the fourth column). On one hand, these high-frequency components cannot be synthesized well in GAN-fake images. On the other hand, they are degraded by JPEG compression for both real and fake images as well. JPEG compression offers a masking effect on the generation artifact in fake image detection with respect to these two challenging categories.

Similarly, we conduct frequency analysis of image resizing in Figure 9. Images from the citysc category contain street views from car cameras and its content contains many vertical edges. As shown in the figure, resizing introduces stronger vertical distortion on images from the citysc category as compared to other categories. These vertical edges in raw images offer good cues for fake image detection. Since these cues are masked by resizing, it becomes more challenging to differentiate real and fake images.

The same phenomenon is observed for the ap2or, citysc and map2sat categories under the additive noise manipulation as shown in Figure 10. By comparing the spectra before and after additive noise, we see that ap2or, citysc and map2sat images are more affected by additive noise than Cezanne and win2sum images. It is worthwhile to point out that the difference in spectral image for the satellite map category is not as obvious as that for the citysc category. This is because the satellite map images are much larger in size and the scales of their spectral images are actually different.

From analysis in Section 5.1, we see that leaving a specific semantic category out during training can affect the performance for certain semantic categories under image manipulation scenarios. For example, if we leave the ap2or semantic category out in JPEG compression, its performance becomes much worse as shown in Table 2.

Actually, the Leave-One-Out setting is not practical in real-world forensics. It is reasonable to assume that we can have access to all semantic category images when we are confronted with fake image attacks. For this reason, we propose another experimental setting called Leave-None-Out, where all semantic categories in the CycleGAN dataset are employed in the training process. In this setting, we enlarge the training dataset by including 10% of test category images and use the other 90% of test category images in testing.

Since this setting only includes a small number of test category images in the training set, we can still examine the detection performance and robustness of our model with respect to a specific semantic category. We conduct experiments under the Leave-None-Out setting for each manipulation and show the results in Tables 6, 7, and 8 for JPEG compression, resizing, and additive noise, respectively. We use^* to denote the result under the Leave-None-Out setting. As compared with the Leave-One-Out setting, we observe a 3-20% test accuracy increase for the new setting. For example, for image resizing with a resize factor of 0.5, the test accuracy of RGGID improves from 70.03% to 93.09% for the citysc category with an ensemble of all three filter banks.

The proposed RGGID method is a green solution since it has low computational and memory complexity and it can achieve high performance with weak supervision as discussed below.

We compute the model size for each component in Table 9. The model parameters of RGGID include PixelHop filter parameters, soft classifier parameters, and ensemble classifier parameters. The number of soft classifier parameters is proportional to the number of selected channels. For example, for individual filter banks, if the filter size is s × s × c and the selected channel number is k, the number of PixelHop filter parameters is s² × c × k. For ensemble schemes, to obtain the total number of PixelHop filter parameters, we sum across the filter banks in the ensemble. For the soft classifier parameters, we train each XGBoost classifier with 100 trees, and each tree has a maximum depth of 6. The total number of soft classifier parameters is equal to the number of channels multiplied by 19k. The ensemble classifier is a shallow XGBoost classifier with only 10 trees and each tree has a depth of 1. Thus, the number of ensemble classifier parameters is 40. For the various settings, we see that the model size ranges from 76.2k to 231.2k parameters.

The model sizes of other state-of-the-art fake image detection models on the raw CycleGAN dataset are given in Table 10. DNN models such as DenseNet, InceptionNet and XceptionNet have millions of parameters. A shallow CNN that has two convolutional layers and one fully connected layer was introduced by Cozzolino et al. [8]. Its model has only 1k parameters. Auto-Spec [24] uses ResNet-34 as a classification network and has 21.8M parameters. Nataraj et al. [18] used a neural network for feature extraction and classification, and its model size is 730k. In contrast, RGGID has a minimum of 76.2k parameters (with the 2 × 2 × 3 filter bank) and a maximum of 231.2k parameters (with the ensemble of all three filter banks). Its model size is significantly smaller than those of DNNs.

We measure the training time from scratch on CPU Intel(R) Core(TM) i7-5930K CPU @ 3.50GHz. The average training time for each category is 1.9 hours, yielding a total training time of 19 hours for all 10 categories. Other existing models need GPU and they often rely on pre-trained models.

As reported in Table 1, RGGID can achieve an accuracy of 99.0% on the raw image dataset based on 10% of training images from each training category. We also conducted experiments using only 1%, 2%, ⋯,8% and 9% of training data from each semantic category and show the corresponding test accuracies in Figure 11 for the 2 × 2 × 3 filter bank. Its test accuracy reaches 93% even with 1% of the original training images. It converges to 99% using only 5% of the original training images. This shows that RGGID can perform well even under extremely weak supervision.

A green and robust GAN-fake image detector called RGGID was proposed in this work. It was developed under the assumption that GANs fail to generate high-frequency components of real images in high fidelity. Thus, it focuses on complex local regions that have high-frequency components and employs a set of local filters, called filter banks or PixelHops, to extract features. Discriminant channels were identified and their responses were used as features and fed into the XGBoost classifier for soft decision. Finally, various ensemble schemes were adopted to make RGGID adaptive to different semantic categories and robust with respect to compression, resize and additive noise manipulations. It was shown by experimental results that RGGID can maintain good detection performance against these manipulations.

The robustness of RGGID was conducted against the CycleGAN dataset in this work. As future extension, it is interesting to test the robustness of RGGID against different GANs in a cross-GAN setting. That is, we may train the RGGID model solely on real images and ProGAN fake images and then test it on images generated by other GANs.