AI image generator swaps caught by forensic acceptance region tests
FARE: Forensic Acceptance Region Estimation for Catching Bait-and-Switch Image Generators
Computer Vision and Pattern RecognitionArtificial IntelligenceCryptography and Security
Summary
AI services that create images often hide their inner workings, letting companies secretly swap a trusted model for a cheaper one. This can reduce quality or trust in important situations. The authors created FARE, a tool that learns the unique patterns of a certified image generator by training on its pictures. Later, FARE checks if new images really come from the certified model, catching hidden swaps by spotting subtle differences. This helps keep AI image services honest and reliable.
What this means in practice
- •For ai service providers: Detect secretly swapped image generators in deployed AI image APIs to maintain certified model integrity and trust.
- •For digital forensics teams: Identify images generated by unauthorized AI models in critical settings by analyzing generator-specific forensic artifacts with minimal data.
Authors
Kai Yao, Marc Juarez
Abstract
Modern AI image generators are increasingly deployed as opaque APIs, where customers can query the deployed service, but cannot inspect model weights or architecture. This creates a practical challenge: a provider may pass governance certification with one generator and later silently switch to a cheaper and lower-quality one for deployment, compromising public trust or even safety in high-stakes domains. We study integrity auditing at deployment time and propose FARE (Forensic Acceptance Region Estimation). A certified generator is enrolled by training FARE on images sampled from that generator. After deployment, FARE can determine whether a generated image is consistent with the enrolled generator---using only that image. FARE's features are based on image generator-specific artifacts that have been proposed for forensic applications. FARE amplifies these features during training by finding hard samples that tighten the acceptance region and increase sensitivity to subtle changes in the certified generator. Across generator swaps, including substitutions with similar model versions and model variants, FARE is effective at detecting swaps, consistently outperforming existing baselines at strict operating points, and remains effective under the exact-model and decision-only attacks evaluated in this work.