# Organic or Diffused: Can We Distinguish Human Art from AI-generated Images?

Anna Yoo Jeong Ha∗, Josephine Passananti∗, Ronik Bhaskar, Shawn Shan, Reid
Southen1, Haitao Zheng, Ben Y. Zhao
Department of Computer Science, University of Chicago,1Concept Artist
{annaha, josephinep, rbhaskar, shawnshan, htzheng<EMAIL_ADDRESS><EMAIL_ADDRESS>
# Organic or Diffused: Can We Distinguish Human Art from AI-generated Images?

Anna Yoo Jeong Ha∗, Josephine Passananti∗, Ronik Bhaskar, Shawn Shan, Reid
Southen1, Haitao Zheng, Ben Y. Zhao
Department of Computer Science, University of Chicago,1Concept Artist
{annaha, josephinep, rbhaskar, shawnshan, htzheng<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract.

The advent of generative AI images has completely disrupted the art world.
Distinguishing AI generated images from human art is a challenging problem
whose impact is growing over time. A failure to address this problem allows
bad actors to defraud individuals paying a premium for human art and companies
whose stated policies forbid AI imagery. It is also critical for content
owners to establish copyright, and for model trainers interested in curating
training data in order to avoid potential model collapse.

There are several different approaches to distinguishing human art from AI
images, including classifiers trained by supervised learning, research tools
targeting diffusion models, and identification by professional artists using
their knowledge of artistic techniques. In this paper, we seek to understand
how well these approaches can perform against today’s modern generative models
in both benign and adversarial settings. We curate real human art across 7
styles, generate matching images from 5 generative models, and apply 8
detectors (5 automated detectors and 3 different human groups including 180
crowdworkers, 4000+ professional artists, and 13 expert artists experienced at
detecting AI). Both Hive and expert artists do very well, but make mistakes in
different ways (Hive is weaker against adversarial perturbations while Expert
artists produce higher false positives). We believe these weaknesses will
remain as models continue to evolve, and use our data to demonstrate why a
combined team of human and automated detectors provides the best combination
of accuracy and robustness.

Figure 1. Samples from curated test set. Human artwork and subsequent matching
images produced by generative AI models.

##  1\. Introduction

Creative expression through artwork is intrinsic to the human experience. From
cave paintings by Neanderthals and Homo sapiens, to modern abstract masters
like Kandinsky, Pollock and Mitchell, human art connects us by evoking shared
experiences, trauma, and hopes and dreams.

Yet this might all be changing with the proliferation of output from
generative image models like Midjourney, DALL-E 3, Stable Diffusion XL (SDXL)
and Adobe Firefly. Given prompts as short as a single word, these models can
generate glossy images that at a glance, resemble the work of a professional
artist or fine photographer. As they continue to evolve, it is becoming
increasingly difficult to distinguish art produced by human creatives and
images produced by generative AI.

Identifying if a piece of art is human-made or AI-generated is critical for a
number of reasons. First, individuals and companies are often willing to pay a
premium for human art over AI content. Also, companies or creative groups have
policies restricting the use of AI-generated imagery in competitions, work
product, or ad campaigns. Yet recent news is littered with examples of fraud,
where AI-generated images are sold as human art to individuals (Wilson, 2024;
Ong, 2023) and publishers (Show”, 2024; Codega, 2023b), and used in ad
campaigns or submitted to creative competitions against AI policies (Sato,
2023; Page-Katz, 2023). This has resulted in numerous controversies
(Bousquette, 2023; Dupre, 2023; Northup, 2023), retracted ads and publications
(Staff”, 2023; Codega, 2023a), and public apologies (MaxonVFX, 2024; Show”,
2024).

Second, identification of AI images is also a legal and regulatory issue.
Commercial companies want to copyright their creative content, but the US
Copyright Office has ruled that only human created artwork (or human
contributions to hybrid artwork) can be copyrighted (Small, 2023). Thus
businesses using generative AI might try to pass off AI images as human art to
obtain copyright. Finally, multiple projects have shown evidence that both
text and image AI models will degrade if only trained on output of AI models
(Shumailov et al., 2023; Briesch et al., 2023; Alemohammad et al., 2023). Thus
AI model trainers also need to distinguish AI-generated images from human art
for training purposes.

All of this begs the question, do we have the tools today to reliably and
consistently distinguish AI-generated imagery from human-created art? There
are multiple potential solutions. First, human artists are often quite good at
recognizing human art, and some experts have demonstrated a consistent ability
to detect AI images trying to pass as human art (Gach, 2023; Ong, 2023; Sato,
2023; Shaffi, 2023). Alternatively, specific companies like Hive, Optic and
Illuminarty have trained supervised classifiers to distinguish AI imagery from
human art. Online media has raised questions on the accuracy of these
detectors amid their growing impact on news media (Maiberg, 2023). Finally,
recent research results like DIRE and DE-FAKE (Wang et al., 2023a; Sha et al.,
2023) suggest specific techniques to recognize images produced by diffusion
models, including all of the major generative models today.

The goal of our work is to systematically and comprehensively explore the
effectiveness of these detectors at distinguishing AI-generated images and
human art111Unlike most prior studies, our focus is not identifying deepfake
images from real photographs. Instead our focus is on determining the
provenance of creative art imagery, and our inclusion of photography focuses
on photographs as art, not as records of real events.. We consider a wide
range of imagery, including 7 distinct art styles, each represented by samples
of human art, images generated by each of 5 generative AI models, AI images
painted over by humans (hybrid), and human photography enhanced by AI. We also
consider a range of “detection methods,” including 5 automated tools (3
deployed classifiers Hive, Optic, Illuminarty and 2 research detectors DIRE
and DE-FAKE) and 3 different populations of “human detectors” (crowdsourced
non-artists, professional artists, and expert artists). Finally, we also
consider adversarial scenarios, where AI-generated images are augmented with
noise and adversarial perturbations with the intention of bypassing detection.

In total, we curated a dataset of 280 real human art images across 7 different
styles, and 350 generated AI-based images from generative models using prompts
automatically extracted from each of the human art images. One component of
our study tests the efficacy of automated detectors on these images and their
perturbed variants; and the other part evaluates human-based detection.  The
latter involves 3 separate user studies on: a) 180 crowdworkers on the
Prolific platform, b) 4000+ professional artist volunteers  recruited from
social media artist groups, and c) 13 expert professional artists who have
experience identifying generative AI images.

Our study produces a number of significant findings:

  * •

We find that normal, non-artist users are generally unable to tell the
difference between human art and AI-generated images. Professional artists are
more confident and perform much better on average, and expert artists more so.

  * •

Supervised classification does surprisingly well, and Hive outperforms all
detectors (human and ML), and produces zero false positives. Unsurprisingly,
accuracy seems to correlate with expected training data availability: biggest
classifier (Hive) performs best; all classifiers perform the worst on Firefly,
the newest of the major generative models.

  * •

Fine tuned models that mimic human artists, and real images modified with AI
upscaling posed no significant challenges to human or ML detectors.

  * •

Adversarial perturbations did have significant impact on ML detectors such as
Hive, with feature space perturbations being the most effective.

  * •

Expert human artists perform very well in detecting AI-generated images, but
often attribute mistakes and lower skill by human artists as evidence of AI
images, thus producing false positives.

  * •

A combined team of human and automated detectors provides the best combination
of accuracy and robustness.

##  2\. Background and Related Work

We begin by providing background on generative AI image models using the
diffusion model architecture, and on currently available automated detectors
of generative AI images. We then discuss existing work related to our study.

###  2.1. Generative Image Diffusion models

First introduced in 2020, diffusion models (Ho et al., 2020) quickly replaced
GANs as the state-of-the-art models for image synthesis (Dhariwal and Nichol,
2021). This was quickly followed by extension to text-to-image generation
(Ramesh et al., 2022; Nichol et al., 2022). Later instances included multiple
open-source models from Stable Diffusion (Rombach et al., 2022; Stability AI,
2022; Podell et al., 2023; StabilityAI, 2022a, b), and commercial models from
Midjourney (Midjourney, 2023), DALL-E (OpenAI, 2022, 2023; Betker, 2023), and
Adobe Firefly (Adobe, 2023). Diffusion models face a growing number of social
and ethical concerns. Base models require enormous amounts of training data,
often obtained without consent through web-scraping. Midjourney trained their
model using data from over 16,000 artists, the vast majority without consent
(Ho, 2024). Stability AI trained on datasets from LAION (Schuhmann et al.,
2022; Rombach et al., 2022), containing millions of copyrighted works. These
copyright infringement issues have led to multiple class-action lawsuits
(CourtListener, 2024; Joseph Saveri Law Firm LLP, 2023). Even in smaller
volumes, artists are finding their works being used without consent in
finetuned models using techniques such as LoRA (BAIO, 2022). As these models
continue to improve in quality, many of their users have attempted to pass AI-
generated images as human art. AI-generated images have been used to win art
competitions, fooling judges of digital art, photography, and book covers
(Roose, 2022; Glynn, 2023; Sato, 2023). Companies that promote human art have
found themselves using AI content provided to them by third-party vendors
(Orland, 2024).

###  2.2. Automated AI-Image Detectors

A number of software and web services offer the ability to detect if an image
is generated by generative AI image models. We group these detectors into two
categories: deployed commercial detectors and research-based detectors.

Research-based detectors. These come from published research papers that often
offer source code and training/testing datasets, sometimes also with
pretrained models. While they lack the same public reach and influence as
commercial detectors, they offer the benefit of transparency in methodology.
Two such detectors are the DIRE detector (Wang et al., 2023a) and DE-FAKE (Sha
et al., 2023). DIRE, or Diffusion Reconstruction Error, aims to exploit the
forwards and backwards diffusion processes (Ho et al., 2020) to identify
images generated by that model (Wang et al., 2023a). DE-FAKE uses both image-
only and multimodal embeddings (Radford et al., 2021) to create a model-
agnostic detector (Sha et al., 2023).

Commercial detectors. These detectors are deployed online, generally as web
services with a tiered pricing model and a web-based non-transparent (black-
box) detection API. They provide easy access to image classification with
minimal computational requirements, Among the most popular are Hive AI
Detector (Hive), Optic AI or Not (Optic), and Illuminarty (Hive, 2023; Optic,
2023; Illuminarty, 2023). All three services advertise free demo plans via a
web UI with high accuracy, and are well covered by popular media (Emmanuel,
2023; Thompson and Hsu, 2023; Steele, 2023).

Beyond DIRE and DE-FAKE, other techniques have been proposed to detect AI-
generated images. Diffusion models can embed invisible watermarks into images
during generation (Braudaway, 1997). Diffusion watermarks involve manipulating
the initial noise vector, creating watermarks robust to some perturbations
(Wen et al., 2023; Zhang et al., 2024). However, this approach requires
modifying the diffusion model. Finally, other detection methods make use of
frequency domain analysis to detect AI-generated images as outliers (Bi et
al., 2023).

###  2.3. Related work

Detecting Deepfake Photographs. While our study focuses on distinguishing
human art from AI-generated images, several prior studies have focused on
human detection of deepfake photos generated by machine learning models. (Bray
et al., 2023) evaluates users’ ability to detect deepfakes of human faces
using StyleGAN2 (Karras et al., 2020), and finds that human participants have
below 65% accuracy in all experiments, even when taught how to recognize
deepfakes. Similarly, (Lu et al., 2023) evaluates human detection on a set of
real photos and photorealistic images from Midjourney V5 (Midjourney, 2023).
They also create a dataset of roughly two million fake images to train ML
detectors. While humans misclassify 37% of images, the best-performing ML
detector misclassifies 13% of the same evaluation set.

Several projects explore robust evaluation and robust training techniques to
improve detection accuracy. (Wang et al., 2020) proposes training data
augmentation using flipping, blurring, and JPEG compression; (Song et al.,
2023) evaluates detection under perturbations of color contrast, color
saturation, blurring, and pixelation; (Bammey, 2020) performs data
augmentation with JPEG compression; and (Hooda et al., 2024) uses an ensemble
of detectors over the frequency domain to improve detection robustness.

Explainability in Image Identification. Some have explored explainability in
detecting AI images. (Ricker et al., 2023) studies distributions of GAN,
diffusion, and real images, showing greater overlap between diffusion and real
distributions than between GANs and real distributions. (Bird and Lotfi, 2023)
creates a counterfactual, generated dataset to CIFAR-10 (Krizhevsky and
Hinton, 2009) and uses gradient heatmaps to visualize important features for
detection. (Corvi et al., 2023) performs forensic analysis on the frequency
domain distributions of various diffusion and GAN models.

AI Images and Art. The abundance of prior work has almost entirely focused on
detecting deepfakes and photorealistic images, including some very large fake
image benchmarks (Zhu et al., 2023; Lu et al., 2023). DE-FAKE briefly mentions
detecting art but only tests on 50 pieces of human art and 50 AI-generated
images. Deepart (Wang et al., 2023b) is an art-based dataset composed of a
random selection of images selected from LAION-5B (Schuhmann et al., 2022),
designed as a training dataset for a classifier to detect AI-generated art.

##  3\. Methodology

AI-generated images have already become exceptionally good at mimicking human
art. Distinguishing these generated images from human art is critical for
individual and institutional consumers, for copyright reasons, and for AI
models seeking to curate their training datasets. The goal of this study is to
understand how feasible this task is today given recent advances in these
generative models, how and why current detectors make mistakes, and what that
portends for the future.

###  3.1. Overview: Goals and Challenges

In tackling this multifaceted problem, our goal is to try to explore several
broad questions on this topic:

  1. (1)

Are there detection methods today, human or automated, that can accurately
distinguish between human art and AI-generated images? How do artists using
their knowledge of art fundamentals fare against semantically-agnostic
supervised classification and research tools designed specifically to detect
diffusion model output?

  2. (2)

What are limitations of current detectors, and why do they make mistakes?

  3. (3)

How well do detectors perform under adversarial conditions, i.e. against
images altered to avoid identification?

  4. (4)

Are there fundamental trends in performance of detection approaches, and what
are implications as models continue to evolve?

As the first research study to perform a comprehensive analysis of classifying
human art and AI-generated images, our most significant challenge is how to
capture the numerous dimensions of this problem. Most specifically, we
consider and incorporate five different dimensions into our study. We
summarize these here and present further details as we describe our
experimental methodology in the remainder of this section.

  * •

Art Styles. Generative AI image models have a wide range of success when
mimicking different styles of art. Therefore, our evaluation must cover a wide
range of art styles, from anime to sketches to fine photography.

  * •

Sources/Types of AI-Generated Images. Different AI models vary in their
ability to mimic human art. Thus we must consider a representative set of
current diffusion models, as well as more unorthodox image types such as
hybrid (AI-generated images painted/altered by humans) and upscaled (human-
generated photography expanded in resolution using AI models).

  * •

Range of Automated AI Image Detectors. We include results of the most popular
available automated detectors (Hive, Optic, Illuminarty) as well as research
prototypes (DIRE, DE-FAKE).

  * •

Range of Human AI Image Detectors. Humans will vary significantly in their
ability to identify human art vs AI images, depending on their knowledge and
experience in producing art. We consider three user groups: regular users
(non-artists), professional artists, and expert artists experienced in
identifying AI images.

  * •

Range of Adversarial Countermeasures. Multiple factors incentivize AI model
users to alter their images to escape identification as AI images. Thus our
study also considers multiple types of adversarial perturbations and explore
their ability to confuse different detectors (both automated and human).

###  3.2. Evaluating Automated Detectors

For automated software-based detectors, we consider both deployed commercial
systems, as well as research-based systems. There are three well-known
deployed commercial systems:

  * •

Hive: AI content detection using supervised classification provided by
thehive.ai.

  * •

Optic: “AI or Not” is a free service (for limited queries) running a
proprietary algorithm to detect AI images and audio.

  * •

Illuminarty: an AI detection service running a proprietary algorithm including
an implementation of DIRE.

For research-based systems, we selected two recent systems that had code (and
models) available for testing.

  * •

DIRE (Wang et al., 2023a): DIRE (Diffusion Reconstruction Error) pushes a test
sample forwards and backwards through a diffusion pipeline and measures its
changes to detect if the image came from that pipeline. DIRE has pretrained
models with a public implementation.

  * •

DE-FAKE (Sha et al., 2023): DE-FAKE uses both image-only and multimodal
embeddings to create a model-agnostic detector. We trained a model based on
techniques from the paper.

We evaluate both automated detectors and human detection on the same core test
dataset of images (280 human art pieces, 350 AI images, 40 hybrid images),
described in more detail in Section 4. However, we also test automated
detectors against a variety of adversarial perturbations including Gaussian
noise, JPEG compression, adversarial perturbations, and the Glaze style
mimicry protection tool (Shan et al., 2023).

###  3.3. Evaluating Human Detection: User Studies

Recent events have shown human artists to be exceptionally successful at
identifying AI-generated imagery masquerading as human art (Gach, 2023; Ong,
2023; Sato, 2023; Shaffi, 2023). Instead of looking for statistical properties
of images, human artists look for inconsistencies in artistic technique, flaws
in logic/composition, and other domain-specific properties that diffusion
models do not understand.

Our study evaluates how well skilled artists can use their understanding of
art to detect AI-generated images, by performing separate user studies for 3
separate user populations.

  * •

Baseline Participants. We recruited 180 crowdworkers through the Prolific
online crowdsourcing platform (177 completed and passed consistency checks).
Participants were compensated $2/10min and this group took on average 8
minutes to complete. This group included no full-time professional artists and
7 part-time artists.

  * •

Professional Artist Volunteers. We asked for artist volunteers on social media
to participate. Of more than 4000 who responded, 3803 completed the survey and
passed all consistency checks.

  * •

Expert Participants. We recruited 13 high-profile professional artists known
by members of the research team to have experience identifying AI imagery.
These expert artists are compensated $25 for completing the initial survey and
detailed feedback, and $25 more for participating in the Glaze perturbation
user study.

Procedure. The basic user survey included a randomized sample set of real
human artwork, hybrid images, and generative AI images. We ask participants to
classify each image as human-generated, unsure, or AI-generated. We also ask
if they have seen the image displayed before, and answers to previously seen
images are discarded. We ask questions about their artistic expertise, what
styles of art they found easier to classify than others, and factors that
influenced their classification.

We also presented the expert team with a small fixed sample set of AI
generated images that produced the most misclassifications in the other user
studies. In an interactive chat setting, we asked the experts for detailed
feedback on techniques and specific examples applicable to each of these
difficult images.

###  3.4. Data Collection

We curated our own dataset of real human-created artwork, AI-generated images,
and hybrid images. We define real images as original artwork drawn or created
by human artists. AI-generated images are images that are generated using AI
models like Midjourney, Stable Diffusion and DALL-E 3 from text prompts.
Hybrid images are images that are AI-generated, retouched, and partially drawn
over by humans. One of the coauthors is a professional artist with over 30
years of experience. He scanned numerous social media sites and art platforms
and collected a set of 40 images whose creators admitted they were AI-
generated images altered by human artists later. We describe our data
collection process in detail next.

##  4\. Constructing the Dataset

We consider images of diverse art styles and sources. We curate a dataset
consisting of four different groups of images: artworks handcrafted by human
artists (§4.1), AI-generated images (§4.2), perturbed versions of human
artworks and AI images (§4.3), and unusual images created by combining human
and AI efforts (§4.4).

###  4.1. Human Artworks

Human artworks are novel creations by artists that capture their personal
touch and emotions. They showcase the unique techniques, styles and
perspectives of individual artists that only come from years of training and
experiences. With help from the artist community, we collected artworks across
7 major art styles, including anime, cartoon, fantasy, oil/acrylic,
photography, sketch, and watercolor. We recruited artist volunteers from Cara
(Cara, [n. d.]), a major portfolio platform dedicated for human-made art. When
recruiting volunteers, we provided artists with a detailed explanation of the
study’s scope and operations. We sought their consent to use their artworks in
the study and offered them the option to opt out if they were not comfortable
with their works being included.

Overall, we recruited 53 artists and received 280 distinct artworks, mapping
to 40 images per style. For each style, we recruited 5 artists specialized for
this style and each artist sent us 8 digital images of their own artworks. The
only exception is the watercolor style, where we recruited 7 artists and the
number of images sent per artist varies between 4 and 11.

Many artists choose to protect their intellectual property by adding digital
signatures or watermarks onto the images of their original artworks. However,
many AI-generated images do not have these distinctive marks. Therefore, the
presence of signatures or watermarks can potentially influence the perception
of human art, introducing unwanted bias and susceptibility to manipulation. To
address this issue, we obtained consent from the artists to crop out any
signatures or watermarks from their submitted images. In cases where the mark
was too adjacent to the art subject, we communicated with the artists to
request the original artwork image free of such markings. Finally, all images
were cropped to achieve a square shape, with efforts made to minimize any
potential loss of content. This is to maintain consistency between human
artworks and AI-generated images, since the latter is of a square shape.

Ethics. Aside from obtaining consent from artists, we take great efforts to
minimize exposure of human artworks to external sources. We provide details in
§9.

###  4.2. AI-Generated Images

For AI-generated images, we take effort to cover the 7 art styles (listed
above) and different AI generators. We consider the five most popular AI
generators: CIVITAI (Civitai, 2022), DALL-E 3 (OpenAI, 2023), Adobe Firefly
(Adobe, 2023), MidjourneyV6 (Franzen, 2023), and Stable Diffusion XL (SDXL)
(Podell et al., 2023). All were the latest release at the time of submission.
For each art style, we prompt each AI generator to produce 10 images, for a
total of 50 images across all five generators. This produces 350 AI-generated
images in total. Table 12 in Appendix summarizes the # of images curated as
human artworks and AI-generated images.

Configurating Prompts for Each Art Style. We create prompts for AI generators
by running BLIP (Li et al., 2023) on human artworks submitted by artists,
generating captions that effectively capture both the artwork’s style and
content. BLIP stands out as the state-of-the-art model for image captioning.
We apply this method to improve consistency, because artworks of the same
style often display large variation in content type and scene. For each art
style, we randomly select 10 human artworks, making sure to include at least
one piece per contributing artist. The chosen images are input to BLIP to
extract the captions.

Here we encounter an issue where, for some artworks, BLIP struggles to extract
the correct art style or any style at all. For example, for some anime
artworks, BLIP generates captions accurately describing the content but fails
to include any style. When prompted by this caption, the AI generators
consistently produce images in the photohumanistic style instead of the
intended anime style, despite the substantial difference between the two.
Similarly, BLIP also fails to extract the watercolor style. In our study, we
address this issue by adjusting the BLIP-generated captions to include the
style of the artwork, for which we have ground truth. Table 13 in Appendix
summarizes the modification made for each art style.

Customizing Prompts per AI Generator. We also make customized adjustments on
BLIP-generated captions to address unique restrictions and configurations that
each AI generator impose on prompts. Specifically, Adobe’s Firefly and
OpenAI’s DALL-E 3 models do not respond to prompts that contain certain
content. For instance, Firefly does not generate any image when prompted with
“a fantasy style image of a woman in black holding a knife in the snow,” but
responds properly when the word “knife” is replaced with “sword.” Similarly,
DALL-E 3 does not react to prompts containing copyrighted materials such as
Marvel character names (e.g., Spider-Man) and Nintendo game names (e.g., The
Legend of Zelda). To address this, we manually substitute such content with
more generic terms like “ superhero-themed action figures” or “a fantasy-
themed action figure on a horse.” We verify that the modified prompts do
produce images that aligned with the intended description.

Another issue is the inconsistent aspect ratio of generated images. Four out
of the five generators consistently produce square images. DALL-E 3, on the
other hand, generates images with random aspect ratios (e.g.
1024$\times$1792). DALL-E 3 also tends to self-elaborate on the input prompt,
producing extraneous intricacies. To address these artifacts, we include, in
each input prompt to DALL-E 3, the additional phrase of “square image prompt
the text to Dall-e exactly, with no modifications.” Doing so effectively
restricts its operation to adhere to the original prompt and return a square
image.

Selecting Art Style from CIVITAI. Unlike other models, CIVITAI hosts instances
of SDXL fine-tuned on specific art styles. For each art style, we locate the
most frequently downloaded model from CIVITAI with that style. For instance,
we use “Anime Art Diffusion XL” to generate anime style images.

###  4.3. Perturbed Images

Users of AI-generated images can intentionally add perturbations to images to
deter their identification as AI images. We consider four representative types
of perturbations and describe each below. Appendix (Fig 7) provides visual
samples of perturbed images.

Perturbation #1: JPEG Compression. Existing work has shown that compression
artifacts can reduce the accuracy of image classifiers (Lam et al., 1999;
Hamano et al., [n. d.]; Lau et al., 2003). To study its impact on AI image
detectors, we follow prior work to apply JPEG compression of a quality factor
15 (Spring et al., 2016) to AI-generated images before querying these
classifiers.

Perturbation #2: Gaussian Noise. Similarly, digital noises can be introduced
to disrupt classification-based detectors. For our study, we apply zero-mean
Gaussian noise to each pixel value, with a standard deviation limited to
0.025, a parameter sweetspot with maximum impact and minimal visual
disturbance.

Perturbation #3: CLIP-based Adversarial Perturbation. A more advanced (and
costly) approach is to apply adversarial perturbations on AI images.
Adversarial perturbations (Goodfellow et al., 2014; Madry et al., 2017) are
carefully crafted pixel-level perturbations that can confuse ML classifiers.
Automated AI image detectors are known to rely on the public CLIP model
(Cozzolino et al., 2023; Sha et al., 2023) for detection, and thus, we
leverage the CLIP model to craft our adversarial perturbations to maximize
their transferability to AI detectors (Demontis et al., 2019). Specifically,
we compute LPIPS-based adversarial perturbation (Ghazanfari et al., 2023) on
each AI-generated image. We ensure that the perturbation is sufficient to
confuse the CLIP model (i.e., LPIPS budget = 0.03).

Perturbation #4: Glaze. Glaze (Shan et al., 2023) is a tool for protecting
human artists from unauthorized style mimicry. It introduces imperceivable
perturbations on each artwork, which transforms the image’s art style to a
completely different one in the feature space. The widespread use of Glaze by
artists has sparked extensive online discussions focused on instances where
the use of Glaze on human art results in detection as AI images, while
applying Glaze on AI-generated images can evade detection. To understand its
impact, we use the public WebGlaze (Lab, 2023) tool to perturb both human art
and AI images. We choose both the default medium intensity and also the high
intensity, as artists often employ strongest protection to safeguard their
online images.

###  4.4. Unusual Images

Hybrid Images. Users can create “hybrid” images by painting over AI-generated
images. When posting them online, many include in the caption the generative
models used. One of the coauthors, a professional artist over 30 years of
experience, collected 40 hybrid images to include in our dataset and verified
their sources. The images cover a variety of styles and subjects, including
anime, cartoon, industrial design, and photography.

Human Artworks with Upscaling. Some artists use tools like image upscalers to
enhance the quality of photography images, e.g., reducing blur or noise
introduced during image capturing. We have 70 images in this group, upscaled
using the baseline function of MagnificAI (AI, 2023), a web upscaling tool
endorsed by artists.

##  5\. Accuracy of Automated Detectors

Using the dataset outlined in §4, we examine the efficacy of automated
detectors in detecting AI-generated images. We first report the results on
unperturbed imagery and the impact of AI generator choice. We then consider
advanced scenarios where the detectors face different types of perturbed
images, benign or malicious.

###  5.1. Experiment Setup

As discussed in §3, we consider five classification-based detectors, including
three commercial detectors (Hive, Optic, Illuminarty), and two detectors built
by academic researchers (DIRE, DE-FAKE). Our experiments use both original,
unperturbed imagery (280 human artworks and 350 AI-generated images) and their
perturbed versions. We delay the study of unusual images to §7.3 due to their
decision complexity.

Detector Decisions. We study the ability of automated detectors to identify a
human artwork as human and an AI-generated image as AI, mapping to a binary
decision. However, today’s automated detectors all output a probabilistic
score indicating the likelihood or confidence of the input being AI-generated.
A score of 100% implies absolute certainty that the input is AI-generated,
while 0% indicates it is definitely human art. To convert this score into a
binary decision, we need to establish a boundary that distinguishes between
the two classes. Relying on a single threshold, such as $x$% (e.g., 50%), is
obviously too fragile for this purpose.

Instead, we leverage the widely used 5-point Likert scale in user studies
(Jeong and Lee, 2016), designed to obtain quantitative measures of
perception/decision. Specifically, scores ranging from 0-20% are associated
with category human artwork (very confident), 20-40% with human artwork
(somewhat confident), 40-60% with “not sure,” 60-80% with AI-generated
(somewhat confident), and 80-100% with AI-generated (very confident). It is
important to note that our user studies maintain consistency by adopting the
same rating scale. Next, to produce binary decisions, we designate any score
below 40% as a decision of human art and any score above 60% as a decision of
AI-generated. Those inputs yielding scores between 40-60%, indicating
uncertainty (“not sure”), are excluded from the experiment. This exclusion is
based on two practical considerations. First, there is no equitable method for
comparing a “not sure” decision against the definitive ground truth (Chyung et
al., 2017). Second, the occurrence of “not sure” is minimal across the machine
detectors, e.g., 0.54% for Hive and 4.29% for Optic, thus their removal has a
negligible impact on overall performance.

Evaluation Metrics. We report detector performance using four metrics. For
easy notation, let [H$\rightarrow$H] represent the # of human artworks
detected as human-made, and [AI$\rightarrow$AI] represent the # of AI-
generated images detected as AI-generated. Let [H] and [AI] represent the
total # of human artworks and AI-generated images included in this test,
respectively.

  * •

Overall accuracy (ACC) measures the accuracy of the detector regardless of the
data origin. ACC= ([H$\rightarrow$H]+[AI$\rightarrow$AI])/([H]+[AI]).

  * •

False positive rate (FPR) represents the ratio of human artworks misdetected
as AI-generated. FPR=1- [H$\rightarrow$H]/[H].

  * •

False negative rate (FNR) measures the ratio of AI-generated images
misdetected as human artworks. FNR=1 - [AI$\rightarrow$AI]/[AI].

  * •

AI Detection success rate (ADSR) captures the detector accuracy on AI-
generated images. ADSR= [AI$\rightarrow$AI]/[AI]. We use this metric to
examine how generation-related factors would affect the detection outcome of
AI-generated images.

###  5.2. Results of Unperturbed Imagery

We start from unperturbed human artworks (280 images) and AI-generated images
(350 images). Table 1 summarizes the detection performance in terms of ACC,
FPR and FNR.

Hive. Hive is the clear winner among all five detectors, with a 98.03%
accuracy, 0% FPR (i.e., it never misclassifies human artworks), and 3.17% FNR
(i.e., it rarely misclassifies AI-generated images).

Optic and Illuminarty. Both perform worse than Hive, except that Optic has a
lower FNR (1.15%) and thus is more effective at flagging AI-generated images.
However, this comes at the expense of a high 24.47% FPR, where human art is
misclassified as AI-generated. Illuminarty demonstrates even harsher treatment
towards human art, with a very high FPR of 67.4%.

DE-FAKE and DIRE. We experiment with all 6 versions of DIRE, representing its
6 checkpoints published online. The detailed performance is listed in Table 14
in Appendix. The overall accuracy is consistently low for all 6 models
($<55.5$%). The top-2 models’ performances are listed in Table 1 as DIRE (a)
and DIRE (b), one with nearly 100% FPR, and another with 66% FNR. DE-FAKE
shows a similar pattern, with a low 50% accuracy and high FPR and FNR values.
Given their poor performance, we do not conduct any additional experiments
with both detectors.

Tested on Human Artworks + AI-generated Images
---
Detector | ACC (%) $\uparrow$ | FPR (%) $\downarrow$ | FNR (%) $\downarrow$
Hive | 98.03 | 0.00 | 3.17
Optic | 90.67 | 24.47 | 1.15
Illuminarty | 72.65 | 67.40 | 4.69
DE-FAKE | 50.32 | 41.79 | 56.00
DIRE (a) | 55.40 | 99.29 | 0.86
DIRE (b) | 51.59 | 25.36 | 66.86
Ensemble | 98.75 | 0.48 | 1.71

Table 1. Performance of automated detectors tested on unperturbed human
artworks and AI-generated images. The Ensemble detector
(Hive+Optic+Illuminarty) takes scores from Hive, Optic, and Illuminarty, using
the highest confidence value as the determining score.

Variation across Automated Detectors. The large performance variations across
detectors could be attributed to the diversity and coverage of their training
data. According to its website, Hive utilizes a rich collection of generative
AI datasets and can identify the generative model used for the current input
from a pool of nine models. Similarly, Optic can pinpoint an input image to
one of the 4 generative models. In contrast, Illuminarty’s training data
coverage is limited, particularly since it does not support image files
exceeding 3MB. In our study, we have to downsample images generated by Firefly
from 2048x2048 to 1024x1024 to meet this restriction.

DE-FAKE and DIRE’s training data are constrained and lack representation from
art. DIRE models are trained on interior design images (LSUN-Bedroom), human
faces (CelebA-HQ) and ImageNet. The detection accuracy on art images is around
50%. For DE-FAKE, we follow the methodology described by (Sha et al., 2023) to
train the classifier using images generated by SDXL and MSCOCO captions. When
tested on SDXL images produced from MSCOCO prompts, the classifier reproduces
a high ACC of 92.44% similar to (Sha et al., 2023). However, when tested on
images generated using artwork prompts, the accuracy drops to 50.3% for SDXL
images and 46.43% for those produced by other generators.

Combining Detectors (Hive+Optic+Illuminarty). We also study an Ensemble
detector that leverages decisions from Hive, Optic, and Illuminarty. In case
of a disagreement between the detectors, it opts for the decision marked with
highest confidence. The confidence is calculated relative to the
classification, by computing $|$ detector score - 0.5 $|$. The result in Table
1 shows that the improvement over Hive is minor: 0.6% increase in ACC while
FNR reduces from 3.17% to 1.71% and FPR increases from 0% to 0.48%.

ADSR (%) $\uparrow$
---
| CIVITAI | DALL-E 3 | Firefly | MJv6 | SDXL
Hive | 100.00 | 98.57 | 91.04 | 94.29 | 100.00
Optic | 100.00 | 97.14 | 97.06 | 100.00 | 100.00
Illuminarty | 94.03 | 100.00 | 92.42 | 91.67 | 98.41

Table 2. The impact of AI-generator choice on detector performance,
represented by ADSR, the % of AI-generated images correctly detected as AI-
generated.

###  5.3. Impact of AI Generator Choice

We also investigate the factors that may affect detection performance. While
one might anticipate that the art style could have an impact, we do not
observe any notable effect, at least for the seven major styles considered by
our study. Instead, we observe a considerable impact by the choice of AI-
generator. This can be seen from both Table 2 and Figure 2. Table 2 lists
ADSR, the % of AI-generated images correctly detected as AI, while Figure 2
displays the raw confidence score produced by the detectors.

Across the five AI generators, images by CIVITAI and SDXL are the “easiest” to
detect by Hive and Optic, i.e., 100% ADSR and not a single “not sure”
decision.  Since CIVITAI models are fine-tuned versions of SDXL, this suggests
fine-tuning has minimal impact on AI image detection.

On the other hand, Firefly images are the least detectable – Hive marks 6 out
of 70 Firefly images as human art and 3 as “not sure” while Optic marks 2 as
human art and 2 as “not sure” (Fig. 2).  We hypothesize this is due to lack of
training data. Firefly is a relatively new model, so Hive and Optic are likely
to have much less training data relative to other models

Figure 2. The confidence score produced by automated detectors on images
generated by 5 generators. Detecting images generated by Firefly is the
hardest.

###  5.4. Impact of Perturbations

Our goal is to understand whether adding perturbations to images, whether
benign or malicious, could change detection outcomes. This triggers two
questions below.

Figure 3. Impact of five different perturbations on the Hive confidence score,
for 350 AI-generated images. In each figure, the images are indexed by the
increasing Hive score of unperturbed versions.

ADSR (%) $\uparrow$
---
|  | JPEG
---
comp.
| Gaus.
---
noise
Adver. |  | Glaze
---
(med.)
| Glaze
---
(high)
Unperturbed
Hive | 91.88 | 88.73 | 94.20 | 69.73 | 67.56 | 96.83
Optic | 97.98 | 52.63 | 84.21 | 62.62 | 58.00 | 98.85
Illuminarty | 93.19 | 61.43 | 94.39 | 89.80 | 89.22 | 95.31
Ensemble | 94.29 | 88.86 | 94.57 | 73.71 | 71.43 | 98.29

Table 3. The impact of perturbations on AI-generated images, represented by
ADSR, the % of AI-generated images correctly detected as AI-generated.

Question 1: How do perturbations affect the detection of AI images? We explore
four perturbations: JPEG compression, Gaussian noise, adversarial
perturbations on CLIP, and Glaze at medium and high intensity. The details of
each perturbation are discussed at length in Section §4.3.

Table 3 reports ADSR, the success rate of detecting AI-generated images as AI
when they include one of the four perturbations. As a reference, we include
the ADSR for unperturbed images. We discuss each of the perturbations
individually below, analyzing their impact on each detector.

Figure 3 plots a detailed view of the impacts of perturbations on the scores
assigned by Hive to each image. While we examined these plots for each
detector, we observed relatively similar trends across all, except that Optic
and Illuminarty exhibited higher levels of noise. Hive’s plots are easier to
interpret, both for the perturbed and unperturbed data, thus we only present
them for clarity. Additionally, we identify a set of images that demonstrate
‘robustness’ to any perturbation against Hive and provide a more in-depth
discussion of these images in Table 15 in Appendix.

JPEG Compression. JPEG compression shows minimal impact on performance across
all detectors, as they all remain above 91%. The lossy compression artifacts
don’t hinder the detectors’ ability to detect AI images.

Gaussian Noise. Gaussian noise has little impact on Hive, it does drop both
Optic and Illuminarty in ADSR. Optic’s ADSR decreases to 52.63%, and
Illuminarty’s ADSR decreases to 61.43%, both of which are near random
guessing. On the other hand, Hive’s performance remains relatively high at
88.73% ADSR. These classifiers may have already adapted to the presence of
mild noise in training images and learned to suppress the effects of noise.

Adversarial Perturbation. Of all the perturbations, the adversarial
perturbations on CLIP have the least impact on performance for Hive and
Illuminarty. Optic’s ADSR drops to 84.21%, but Hive and Illuminarty both
remain above 94%. This may indicate relatively low transferability of attacks
in the CLIP space.

Glaze. Across detectors, Glaze at both intensities consistently has a
significant impact on ADSR. Additionally Glaze affects each detector similarly
between medium and high intensity, with the increase in intensity only
resulting in a drop in ADSR ranging from 0.5% to 4%. Glaze has the least
effect on Illuminarty, dropping the ADSR from 95.31% to 89.22% for high-
intensity Glaze. In comparison, Glaze reduces the ADSR for both Hive and Optic
to below 70% while the Ensemble detector is only able to achieve 71.43%. We
explore the effects of Glaze further below.

Question 2: Does Glaze Affect Accuracy Similarly on Human Artwork vs AI-
generated Images To investigate if the detection of human artwork is impacted
similarly to AI-generated images when Glazed, we applied high-intensity Glaze
to both. The detection outcomes, including ACC, FPR and FNR are presented in
Table 4 comparing results with and without Glaze. Our findings reveal a large
reduction in ACC with the use of Glaze, as expected. However, the FNR
significantly increases significantly across all detectors, while the FPR
remains relatively consistent. On Hive, ACC is decreased around 20% and yet
FPR increases only 3.23% while FNR increases almost 30%. Our Ensemble detector
is able to achieve the highest accuracy on Glazed images, but maintains a FNR
of 28.57%. This suggests that glazing human artwork typically does not affect
classification success, but glazing AI-generated images often leads to
misclassification as human artwork. We attribute this to the scarcity of
Glazed images online and thus the lack of Glazed images in the detector’s
training datasets. Additionally Glaze was created to protect human artwork and
has since been adopted by many artists, therefore the distribution of Glazed
human art vs. Glazed AI-generated images online is likely skewed. Once again
this demonstrates the impact of insufficient training data on image-based
classifiers.

| ACC (%) $\uparrow$ | FPR (%) $\downarrow$ | FNR (%) $\downarrow$
---|---|---|---
Hive | 80.81 / 98.03 | 3.23 / 0 | 32.44 / 3.17
Optic | 61.92 / 90.67 | 33.59 / 24.47 | 42.00 / 1.15
Illuminarty | 68.66 / 72.65 | 56.91 / 67.40 | 10.78 / 4.69
Ensemble | 82.70 / 98.75 | 3.21 / 0.48 | 28.57 / 1.71

Table 4. Detection performance on human art and AI-generated images with and
without Glaze (at high intensity), shown as: Glazed / Unperturbed.

###  5.5. Summary of Findings

Our study leads to three key findings.

  * •

Commercial detectors perform surprisingly well, and Hive performs the best. It
is highly accurate (98.03% accuracy) and never misclassifies human artwork in
our test. The other two detectors (Optic and Illuminarty) tend to misclassify
human art as AI.

  * •

Commercial detectors are heavily affected by feature space perturbations
(i.e., Glaze) added to AI-generated images. On the other hand, human artworks
with Glaze are mostly unaffected, as they are still largely detected as human.

  * •

Poor performance on Firefly and Glaze indicates the results are correlated
with training data. Performance of supervised classification depends heavily
on the availability of training data. Detectors are more vulnerable to newer
models with less available training data (Firefly) and adversarial inputs they
have not seen before.

##  6\. User Studies on Human Detection

Next, we measure the ability of human users and artists in identifying AI-
generated images. As discussed in §3.3, we perform user studies with 3
separate user populations, including crowdworkers, professional artists and
expert artists. To ensure uniformity, each group is provided with the same
user study, but the expert group received extended followup questions asking
for detailed examples (Section 6.4). Our study is approved by our local
Institutional Review Board (IRB). We omit the IRB number for anonymity.

###  6.1. Study Setup

Participants. As discussed in §3.3, we recruited three participant groups, and
a total of 3993 participants completed our study and passed all
attention/consistency checks. These include 177 baseline participants
recruited from Prolific, referred to as general users, 3803 professional
artist volunteers, and 13 high profile experts.

Task. Our study takes the form of a user survey. We added attention-check
questions in both the middle and concluding sections of the survey to filter
out low attention participants.

After a brief introduction on generative models and the current issue of
distinguishing between human artworks and AI-generated images, we present the
participant with a sequence of 20 images, shown one at a time, and ask them to
decide whether each image is human-made or AI-generated. For each image, we
ask two questions. The first question is “Have you seen this image before?” If
yes, we disregard the response for this image, since the participant has
likely seen this image and is possibly aware of the image’s true source. The
second question asks them to rate the current image with one of the five
choices: “human art (very confident),” “human art (somewhat confident),” “not
sure,” “AI-generated (somewhat confident),” “AI-generated (very confident).”
For each participant, we randomly sample 20 images from a collection of 670
images, consisting of 210 human artworks, 70 human artworks after upscaling,
350 AI-generated images, and 40 hybrid images.

Next, we ask the participant, for each of the 7 art styles, whether they are
confident at distinguishing human art from AI-generated images. If confident,
we ask them to describe the properties of the art that contributed to their
decisions. Here we present seven options: “content,” “complexity,” “technical
skill,” “perspective,” “lighting,” “consistency,” and an additional text
response section for additional details. Finally, we ask them if they self-
identify as full-time or part time artists and why.

Performance Metrics. Same as the evaluation of automated detectors in §5.1, we
convert each 5-point Likert scale rating into a binary decision. That is, both
“human art (very confident)” and “human art (somewhat confident)” map to a
decision of human art, and “AI-generated (somewhat confident)” and “AI-
generated (very confident)” map to AI-generated. Not decision is produced for
the “not sure” responses, and we ignore them when computing ACC, FPR, FNR and
ADSR (same as §5.1).

###  6.2. Detection Accuracy for General Users

Table 5 shows detection performance of general users, which is only slightly
better than random coin-flip. This shows that general, non-artist users are
unable to tell the difference between human art and AI-generated images.

Table 6 examines the impact of art style on detection accuracy (ACC). For
general users, accuracy is slightly higher on cartoon, fantasy and photography
styles. These three represent a collection of “digital” artworks more
frequently accessible to general users, compared to “physical” art styles like
oil/acrylic, watercolor, and sketch, and other “digital” artworks like anime.
We attribute the slightly higher accuracy to this increased familiarity.
Finally, Table 7 reports detection success rate on AI-generated images, which
is around 60% and varies slightly across the five AI generators. Images
generated by Firefly and MidjourneyV6 are harder for non-artist users to
recognize.

###  6.3. Detection Accuracy for Professional Artists

Compared to general users, professional artists take more time to inspect
images and are more effective at distinguishing between human art and AI
images. They produce a detection accuracy of 75.32% (Table 5). Their 23.53%
FPR and 25.37% FNR indicate that their detection performance is not skewed
toward either human art or AI-generated images.

Decision Factors. To understand why professional artists are better at
evaluating art images, we study the key factors that influenced their
decisions. The first is the image’s art style. Table 6 shows that the image’s
artistic style has a clear impact on the performance of professional artists.
Among the 7 styles, the top-3 “easier-to-detect” styles are anime, cartoon and
fantasy, and the bottom one is oil/acrylic for which the detection accuracy
drops nearly 20%. This aligns with the participants’ feedback on the styles
that they feel most confident on detection, where 82.42% selected cartoon,
followed by fantasy and anime.

For these top-3 styles, the artists select “consistency” as the most dominant
decision factor. Specifically, in the text response section on anime images,
the most frequently entered words are hands, hair, details, eyes and lines.
Similarly, in the case of fantasy images, artists observe specific details
such as asymmetric armor or symbols that should be symmetric. This shows that
professional artists can apply their knowledge and experiences of art creation
to identify inconsistencies in AI-generated images, with particular focus on
fine-grained details.

Impact of AI generator. Table 7 lists the detection success rate of AI-
generated images broken down by source generator model. For professional
artists, accuracy clearly varies across generator models. The top-2 “easiest-
to-detect” are CivitAI and SDXL, with detection success rate above 83%.
Interesting to note that these two are also the most easy-to-identify
generators for automatic detectors. Next, detection accuracy reduces to below
70% for images produced by MidjourneyV6 and DALL-E 3, suggesting that
MidjourneyV6 and DALL-E 3 produce better copies of human art styles, making it
harder for artists to spot inconsistencies.

| ACC (%) $\uparrow$ | FPR (%) $\downarrow$ | FNR (%) $\downarrow$
---|---|---|---
General user | 59.23 | 40.81 | 40.75
Professional artist | 75.32 | 23.53 | 25.37
Expert artist | 83.00 | 20.78 | 14.63

Table 5. Performance of human detection on both human art and AI-generated
images. Figure 4. Six hard-to-detect AI-generated images, and their artistic
errors/inconsistencies discovered by our expert artists. In each 3-image
group, the left one is the full image, and the right two are zoomed-in view of
discovered artifacts.

| Anime | Cartoon | Fantasy | Photo. | Oil/Acrylic | Sketch | Watercolor
---|---|---|---|---|---|---|---
Gen. | 57.43 | 63.58 | 62.80 | 63.23 | 56.81 | 54.99 | 56.16
Pro. | 79.16 | 82.42 | 81.72 | 76.05 | 66.01 | 70.27 | 70.51

Table 6. Impact of art style on detection accuracy (ACC) for general users
(Gen.) and professional artists (Pro.). We exclude the result of expert
artists due to insufficient coverage.

ADSR (%) $\uparrow$
---
| CIVITAI | DALL-E 3 | Firefly | MJv6 | SDXL
General user | 66.77 | 60.63 | 51.18 | 50.00 | 67.56
Professional artist | 83.56 | 67.56 | 75.40 | 61.53 | 84.43
Expert artist | 90.32 | 86.96 | 65.22 | 86.96 | 95.65

Table 7. ADSR of human detection on AI-generated images by different AI
generators. ADSR is the success rate of detection AI-generated images as AI-
generated.

###  6.4. Detection Accuracy for Expert Artists

Our 13 expert artists show greater proficiency in the detection task, raising
overall detection accuracy (ACC) to 83% (see last row in Table 5). They also
produce slightly imbalanced FPR (20.78%) and FNR (14.63%), indicating that
they are better at spotting AI-generated images than human art. When we gave
feedback to the experts on their results, many were frustrated that they
committed errors by marking human art as AI (false positive). In retrospect,
they explained that they identified detailed mistakes and inconsistencies
which were likely due to inexperience and human error by the human artists.
For example, in a painting of a bedroom bathed in moonlight, the shadow of a
window pane had slightly offset position of the latch compared to the window
itself. This was seen by expert artists as an inconsistency, but later
attributed to lack of attention to detail by a human artist.

Decision factors. Our expert artists are generally very confident at judging
images from more than 2 art styles. The most frequently selected one is
fantasy art.  The primary decision factors are intrinsic artistic details,
which often go beyond the “(in)consistency” element used by professional
artists in their detection efforts (as discussed in §6.3). Specifically, our
expert artists point out that AI-generated images generally “look too clean,
rendered, and detailed” and “have no variety in composition, edges,
distribution of detail,” and had “design elements are nonsensical or blend
into each other in telltale ways,” while human-made fantasy art “contains
components that are novel such as armor or jewelry.”

Focus Study on “Hard-to-Detect” AI Images. For a comprehensive view of how
experts identify AI-generated images, we presented our expert group with a
fixed set of the six AI-generated images that produced the most false negative
errors by the professional (non-expert) artist group. They cover 5 styles:
sketch, oil/acrylic, cartoon, watercolor, and anime. For each of these
difficult images, we asked the experts for detailed feedback on what exactly
they would use to identify these images as AI. Figure 4 shows all six images,
each followed by two regions of the image zoomed in to show details of the
artifacts identified by our expert artists.

Next we summarize general techniques identified by experts, and use specific
images to illustrate these methods.

  * •

Consistency in medium. For any specific artwork, a trained artist typically
employs only a single consistent medium, e.g. pencil, charcoal, and rarely
combine multiple mediums. For example, in the sketch in image a), our experts
locate not only a “weird halo effect” (detail 1) due to the use of both pencil
and charcoal, but also a “crunchiness” (detail 2) to the lines that associate
with neither pencil nor charcoal. AI models are associating lines from
multiple mediums with the same style and fail to differentiate between them.
Similarly, oil and acrylic paintings can display messy or smooth styles but
never both. In image image d), the perfectly round moon looks like a digital
art (detail 2), inconsistent with the overall messy painting style. The white
is “too clean” (detail 1) when transitioning into the blue background.

  * •

Intentionality in details. In art featuring human figures, human artists
dedicate considerable effort to convey precise details of human features. In
image b), the light caught in the eyes do not match and the hair ends flow in
opposite directions from the rest of the hair (detail 2). Similarly, in image
c), hairs behind the neck are floating and doing completely different things
from the rest of her hair. Human artists also avoid unusual tangents with the
bangs and eyebrow, something that this image completely overlooked.

  * •

Limitations of medium. Experienced artists know that certain patterns and
details are impossible to produce in real life due to physical limits of the
medium. In image e), since watercolor is transparent and it bleeds after each
brush stroke, the “white over dark in the quills” (detail 1) is impossible to
physically produce. The image is also too smooth to be hand painted on paper
(detail 2), since watercolor bleeds in random directions.

  * •

Domain knowledge. There are specific rules when drawing specific subjects that
are easy to validate. Wet paintings have an order of application, from light
to dark, transparent to opaque. Thus all white spaces must be subtractive. Yet
in image f), the white highlight is added after a dark area, which is wrong.
Also the water flow shows the wrong diffusion pattern. A trained artist should
not make these mistakes.

We consider these techniques in aggregate, and note that most of them require
significant training and external knowledge to apply. In this sense, factors
such as intentionality and domain knowledge seem like the most difficult for
AI models to capture from training data. But as a whole, these domain-specific
filters clearly operate very differently from statistical approaches used in
automated detectors. Thus we believe these methods will continue to be
effective even as AI models continue to evolve.

###  6.5. Summary of Key Findings

Our multi-tier user study finds that general (non-artist) users are unable to
distinguish between human art and AI-generated images. Professional artists
are more confident and make more accurate decisions, and experienced experts
are the most effective. Diving deeper into concrete examples, we learn that
experts leverage extensive knowledge of art mediums and techniques to identify
what features are physically impossible, and inconsistencies and mistakes that
professional artists would avoid.

Metric | Human detector | Machine detector
---|---|---
General | Professional | Expert | Hive | Optic | Illuminarty
ACC (%) $\uparrow$ | 59.23 | 75.32 | 83.00 | 98.03 | 90.67 | 72.65
FPR (%) $\downarrow$ | 40.81 | 23.53 | 20.78 | 0.00 | 24.47 | 67.40
FNR (%) $\downarrow$ | 40.75 | 25.37 | 14.63 | 3.17 | 1.15 | 4.69

Table 8. Performance of human and machine detectors on unperturbed imagery.

##  7\. Human vs. Classifier Detectors

In this section, we present our findings by comparing the performance of human
and machine detectors. Our analysis starts from the baseline results, where
all detectors are tested using the same set of usual images, covering
unperturbed human artworks and AI-generated images. Next, we investigate how
human detectors respond to Glazed images, for which machine detectors have
struggled to handle (as shown in §5.4). Finally, we explore both human and
machine detectors’ responses to unusual images, including both hybrid images
(when human edits AI-generated images) and upscaled human art (where artists
polish the digital image of their artworks using enhancement tools).

###  7.1. Decision Accuracy and Confidence

We start from comparing human and machine detectors on the baseline task of
differentiating

Detection accuracy. Table 8 lists the detection performance of both human
detectors and classifier-based detectors, on unperturbed images. Among the six
detectors, we have Hive $>$ Optic $>$ Expert Artist $>$ Professional Artist
$>$ Illuminarty $>$ Non-Artist.

Decision confidence. We are also interested in understanding the distribution
of decision confidence among human and machine detectors. Figure 5 shows, for
AI-generated images and human artworks, the distribution of the “raw” decision
represented by the 5-point Likert score used by our study. For AI-generated
images (shown by the top figure), the dark blue bar represents the ratio of
correct decisions that also carry high confidence, while for human artworks
(the bottom figure), the dark orange bar captures the ratio of correct
decisions made with high confidence.

Across the three groups of human detectors, general users are the least
accuracy and also show the lowest confidence in their decisions, while expert
artists are the most accurate and the most confident. This is as expected.
Across the three machine detectors, Hive is highly confident (and accurate),
followed by Optic. Additionally, Optic is more confident when facing AI-
generated images than human artworks. Overall, the two machine detectors (Hive
and Optic) show higher confidence (and higher accuracy) than expert artists,
while the third machine detector (Illuminarty) performs worse than both expert
and professional artists.

Figure 5. Distribution of detection decision represented by the 5-point Likert
rating on (a) AI-generated images and (b) human artworks.

###  7.2. Are Human Artists Better at Judging Glazed Images?

As shown by Table 4 in §5.4, machine detectors, especially Hive and Optic, are
much less effective at judging Glazed versions of AI-generated images. Thus a
natural question is “would artists who know or use Glaze be more effective at
judging Glazed images?” To answer this question, we conduct an additional user
study with our expert group, who all use Glaze on their published artworks.
Here we randomly select 100 AI-generated images (20 images per AI generator)
and 100 human artworks (15 images per style, except 10 images for cartoon),
and use the WebGlaze tool and the medium intensity setting to Glaze all 200
images. For each expert artist, we randomly select 20 Glazed images and ask
them to decide between human art and AI-generated.

Table 9 lists the overall performance across Glazed images. We see that human
experts largely outperform both Optic and Illuminarty at judging Glazed
images, whether it is human art or AI-generated. While Hive is still the best-
performing detector in the overall accuracy (87.76%), our expert artists are
not far off (83.44%). But more importantly, human experts achieve a much lower
FNR (8.97%) compared to Hive (20.62%). This implies that human artists do
outperform machines at judging Glazed versions of AI-generated images.

| ACC (%)$\uparrow$ | FPR (%) $\downarrow$ | FNR (%) $\downarrow$
---|---|---|---
Expert Artist | 83.44 | 23.53 | 8.97
Hive | 87.76 | 4.04 | 20.62
Optic | 61.20 | 38.30 | 39.33
Illuminarty | 66.11 | 59.09 | 9.78

Table 9. Detection performance on Glazed version of human artworks and AI-
generated images.

###  7.3. Judging Unusual Images

As discussed in §4.4, we also consider two unusual types of images: (i) hybrid
images produced by human users editing AI-generated images, and (ii) upscaled
human artworks where artists apply digital touchups to polish the image of
their artworks. By evaluating them using both human and machine detectors, our
goal is to identify, if any, notable differences in how they are evaluated by
human and machine detectors.

In total, we collect 70 human artworks after applying upscaling and 40 hybrid
images (see §4.4). Given the limited member size of our expert group, we do
not have sufficient coverage on these images by expert artists and thus omit
their results. Figure 6 in Appendix plots, for both types of images, the
distribution of the “raw” detection decision represented by the 5-point Likert
score, for both human and machine detectors.

Hybrid Images. For these images, the decision distribution is similar to that
of AI-generated images shown in Figure 6(a), suggesting that both human and
machine detectors frequently label these images as AI-generated.

Upscaled Human Art. The decision distribution is very similar to that of human
artworks in Figure 6(b). This implies that upscaling does not have a
significant impact of human artworks in terms of their decision outcomes from
both human and machine detectors.

##  8\. Combining Human and Automated Detectors

Our study shows that both human artists and automated detectors face
challenges in distinguishing between human art and AI-generated images. Tools
like Hive are highly effective at evaluating unperturbed images, but perform
poorly when AI-generated images are intentionally perturbed (e.g., by applying
Glaze) to evade detection. On the other hand, human experts can still identify
AI-generated images when they are Glazed. Thus we believe a more effective
solution is to form a mixed team of human artists and machine classifiers.

Teaming up Hive and Expert Artist. We evaluate the scenario of teaming up Hive
with one expert artist for each image. Now the combined team has two “judges”.
In case of a tie, we use the decision with higher confidence score, i.e.
picking a “very confident” decision over a “somewhat confident” one.

We evaluate the combined detector on both unperturbed artworks/images and
their Glazed versions. Table 10 shows that, for unperturbed images, the
combined detector exhibits a slightly lower accuracy compared to Hive. Next,
Table 11 shows that the combined detector is highly effective in judging
Glazed images, outperforming both Hive and expert. Notably, it outperforms
Hive by lowering FNR from 19.70% down to 8.82%. Thus it is more effective at
identifying AI-generated images that have applied Glaze in an attempt to evade
detection. At the same time, the combined detector achieves a low FPR like
Hive (6.06%), remarkably lower than that of expert (23.08%). Finally, the
equilibrium between FPR and FNR values, on both Glazed and original images
(Table 10), suggests “unbiased” detection accuracy for human artworks and AI-
generated images.

Unperturbed Human Artworks and AI Images
---
Detector | ACC (%)$\uparrow$ | FPR (%) $\downarrow$ | FNR (%) $\downarrow$
Hive | 98.03 | 0.0 | 3.17
expert | 83.00 | 20.78 | 14.63
Hive + expert | 92.19 | 8.11 | 7.63

Table 10. Detection performance on unperturbed human artworks and AI-generated
images. Three detectors: Hive, one expert (per image), Hive + expert
(tiebreak=confidence).

Glazed Human Artworks and AI Images
---
Detector | ACC (%)$\uparrow$ | FPR (%) $\downarrow$ | FNR (%) $\downarrow$
Hive | 87.12 | 6.06 | 19.70
expert | 84.85 | 23.08 | 7.46
Hive + expert | 92.54 | 6.06 | 8.82

Table 11. Detection performance on Glazed human artworks and AI-generated
images. Three detectors: one expert (per image), Hive, Hive + expert (tiebreak
= confidence).

##  9\. Ethics

Our user study protocol was reviewed and approved by our institutional review
board (IRB). In our study design, we prioritized consent and protection of all
participants, particularly human artists and their artworks.

Consent for Human Art. Our study necessitates the use of artwork by human
artists. To obtain consent, we identified artists and reached out with request
for permission. Many responded. We waited roughly 4 weeks, and reached out
again to everyone else. Once downloaded, images are anonymized and stored on
private, secure servers.

Since we asked for artwork from human artists with signatures/watermarks
removed, we were extremely sensitive to potential unauthorized exposure. We
took efforts to minimize the exposure of human artwork to external sources.
They were available to participating crowdsourced workers only for a short
time through the Prolific platform. In the regular artist user study, images
were available to participants for a total of 14 hours, after which we shut
down the study to minimize uncontrolled exposure.

Exposure to Web Services. We took careful steps to ensure that images of human
art were not misused by external AI detection services. We reached out to both
Optic and Illuminarty, and were assured that images are never used for
training and deleted after process (with a max of 4 days for Optic). Hive’s
terms of service states they can train AI models using images uploaded via the
free web service, but not images classified through paid APIs. Thus we
obtained access to a paid Hive account, and ensured all images of human art
were classified using this paid Hive account.

##  10\. Discussion and Takeaways

Distinguishing human art from the output of generative AI models is an
important problem whose impact will only grow with time. This paper describes
the results of our study to determine the efficacy of today’s tools to address
this challenge, including detection via automated tools (supervised
classifiers), detection systems from research, and detection by human artists.

Our results include several counter-intuitive findings with longer term
implications. We find that supervised classifiers can be quite accurate, but
are weaker on input for which it has limited training data on, e.g. newer
models and adversarially altered images. These limitations are likely to
persist with arrival of new generators and adversarial perturbation methods.
In contrast, human artists (especially experienced experts) do well across all
inputs. While experts still fall short of Hive in accuracy, they are more
robust to perturbed images, and their errors often arise from identifying
human artist mistakes as errors made by AI models. Our results show that a
mixed team of human and automated detectors will likely provide the best
combination of detection accuracy and robustness to adversarial measures.

## References

  * (1)
  * Adobe (2023) Adobe. 2023.  Adobe Firefly.  https://www.adobe.com/products/firefly.html.
  * AI (2023) Magnific AI. 2023\.  Magnific.  https://magnific.ai.
  * Alemohammad et al. (2023) Sina Alemohammad, Josue Casco-Rodriguez, Lorenzo Luzi, Ahmed Imtiaz Humayun, Hossein Babaei, Daniel LeJeune, Ali Siahkoohi, and Richard G. Baraniuk. 2023.  Self-Consuming Generative Models Go MAD. In _arXiv preprint arxiv:2307.01850_.
  * BAIO (2022) ANDY BAIO. 2022\.  Invasive Diffusion: How one unwilling illustrator found herself turned into an AI model.
  * Bammey (2020) Quentin Bammey. 2020\.  Synthbuster: Towards Detection of Diffusion Model Generated Images.  _IEEE Open Journal of Signal Processing_ 5 (2020), 1–9.
  * Betker (2023) James et. al. Betker. 2023\.  Improving Image Generation with Better Captions.  _OpenAI_ (2023).
  * Bi et al. (2023) Xiuli Bi, Bo Liu, Fan Yang, Bin Xiao, Weisheng Li, Gao Huang, and Pamela C. Cosman. 2023.  Detecting Generated Images by Real Images Only.  _arXiv preprint arXiv:2311.00962_ (2023).
  * Bird and Lotfi (2023) Jordan J. Bird and Ahmad Lotfi. 2023.  CIFAKE: Image Classification and Explainable Identification of AI-Generated Synthetic Images.  _arXiv preprint arXiv:2303.14126_ (2023).
  * Bousquette (2023) Isabelle Bousquette. 2023\.  Companies Increasingly Fear Backlash Over Their AI Work.  WSJ.
  * Braudaway (1997) G. W. Braudaway. 1997\.  Protecting publicly-available images with an invisible image watermark. In _Proc. of ICIP_. IEEE.
  * Bray et al. (2023) Sergi D. Bray, Shane D. Johnson, and Bennett Kleinberg. 2023\.  Testing human ability to detect ‘deepfake’ images of human faces.  _Journal of Cybersecurity_ (2023), 1–18.
  * Briesch et al. (2023) Martin Briesch, Dominik Sobania, and Franz Rothlauf. 2023\.  Large Language Models Suffer From Their Own Output: An Analysis of the Self-Consuming Training Loop. In _arXiv preprint arxiv:2311.16822_.
  * Cara ([n. d.]) Cara. [n. d.].  https://cara.app/.
  * Chyung et al. (2017) Seung Youn Chyung, Katherine Roberts, Ieva Swanson, and Andrea Hankinson. 2017.  Evidence-Based Survey Design: The Use of a Midpoint on the Likert Scale.  _Performance Improvement_ (2017), 15–23.
  * Civitai (2022) Civitai. 2022\.  What the heck is Civitai?  https://civitai.com/content/guides/what-is-civitai.
  * Codega (2023a) Linda Codega. 2023a.  Dungeons & Dragons Updates Bigby to Replace AI-Enhanced Images.  Gizmodo.
  * Codega (2023b) Linda Codega. 2023b.  New Dungeons & Dragons Sourcebook Features AI Generated Art.  Gizmodo.
  * Corvi et al. (2023) Riccardo Corvi, Davide Cozzolino, Giada Zingarini, Giovanni Poggi, Koki Nagano, and Luisa Verdoliva. 2023.  On The Detection of Synthetic Images Generated by Diffusion Models. In _Proc. of (ICASSP)_.
  * CourtListener (2024) CourtListener. 2024\.  Andersen v. Stability AI Ltd. (3:23-cv-00201).  https://www.courtlistener.com/docket/66732129/andersen-v-stability-ai-ltd/.
  * Cozzolino et al. (2023) Davide Cozzolino, Giovanni Poggi, Riccardo Corvi, Matthias Nießner, and Luisa Verdoliva. 2023\.  Raising the Bar of AI-generated Image Detection with CLIP.  _arXiv preprint arXiv:2312.00195_ (2023).
  * Demontis et al. (2019) Ambra Demontis, Marco Melis, Maura Pintor, Matthew Jagielski, Battista Biggio, Alina Oprea, Cristina Nita-Rotaru, and Fabio Roli. 2019\.  Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks. In _Proc. of USENIX Security_. 321–338.
  * Dhariwal and Nichol (2021) Prafulla Dhariwal and Alexander Nichol. 2021.  Diffusion Models Beat GANs on Image Synthesis.  _Proc. of NeurIPS_.
  * Dupre (2023) Maggie H. Dupre. 2023\.  Sports Illustrated Publisher Fires CEO After AI Scandal.  Futurism.
  * Emmanuel (2023) Salako Emmanuel. 2023\.  AI Tools for Combating Deepfakes.  https://ijnet.org/en/story/ai-tools-combating-deepfakes.
  * Franzen (2023) Carl Franzen. 2023\.  Midjourney V6 is here with in-image text and completely overhauled prompting.  https://venturebeat.com/ai/midjourney-v6-is-here-with-in-image-text-and-completely-overhauled-prompting/.
  * Gach (2023) Ethan Gach. 2023\.  Amazon’s First Official Fallout TV Show Artwork Is an AI-Looking Eyesore.  Kotaku.com.
  * Ghazanfari et al. (2023) Sara Ghazanfari, Siddharth Garg, Prashanth Krishnamurthy, Farshad Khorrami, and Alexandre Araujo. 2023\.  R-LPIPS: An adversarially robust perceptual similarity metric.  _arXiv preprint arXiv:2307.15157_ (2023).
  * Glynn (2023) Paul Glynn. 2023\.  Sony World Photography Award 2023: Winner Refuses Award After Revealing AI Creation.  https://www.bbc.com/news/entertainment-arts-65296763.
  * Goodfellow et al. (2014) Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014\.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_ (2014).
  * Hamano et al. ([n. d.]) Genki Hamano, Shoko Imaizumi, and Hitoshi Kiya. [n. d.].  Effects of JPEG Compression on Vision Transformer Image Classification for Encryption-then-Compression Images.  _Sensors_ ([n. d.]).
  * Hive (2023) Hive. 2023.  AI-Generated Content Classification.  https://thehive.ai/apis/ai-generated-content-classification.
  * Ho et al. (2020) Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020.  Denoising Diffusion Probabilistic Models.  _Proc. of NeurIPS_.
  * Ho (2024) Karen Ho. 2024.  Database of 16,000 Artists Used to Train Midjourney AI, Including 6-Year-Old Child, Garners Criticism.  https://www.artnews.com/art-news/news/midjourney-ai-artists-database-1234691955/.
  * Hooda et al. (2024) Ashish Hooda, Neal Mangaokar, Ryan Feng, Kassem Fawaz, Somesh Jha, and Atul Prakash. 2024\.  D4: Detection of Adversarial Diffusion Deepfakes Using Disjoint Ensembles. In _Proc. of WACV_. IEEE.
  * Illuminarty (2023) Illuminarty. 2023\.  Is an AI Behind Your Image?  https://illuminarty.ai/.
  * Jeong and Lee (2016) Heon Jae Jeong and Wui Chiang Lee. 2016.  The level of collapse we are allowed: comparison of different response scales in safety attitudes questionnaire.  _Biometrics Biostatistics International Journal_ (2016), 128–134.
  * Joseph Saveri Law Firm LLP (2023) Joseph Saveri Law Firm LLP. 2023\.  Class Action Filed Against Stability AI, Midjourney, and DeviantArt for DMCA Violations, Right of Publicity Violations, Unlawful Competition, Breach of TOS.  https://cybernews.com/news/artists-unite-in-legal-battle-against-ai/.
  * Karras et al. (2020) Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. 2020\.  Analyzing and Improving the Image Quality of StyleGAN.  _arXiv preprint arXiv:1912.04958_ (2020).
  * Krizhevsky and Hinton (2009) Alex Krizhevsky and Geoffrey Hinton. 2009.  _Learning multiple layers of features from tiny images_.  Technical Report.
  * Lab (2023) SAND Lab. 2023.  Web Glaze.  https://glaze.cs.uchicago.edu/webglaze.html.
  * Lam et al. (1999) KWK Lam, WL Lau, and ZL Li. 1999.  Effects of JPEG compression on accuracy of image classification.  _Proc. of ACRS_ (1999).
  * Lau et al. (2003) W-L Lau, Z-L Li, and KW-K Lam. 2003.  Effects of JPEG compression on image classification.  _Proc. of IJRS_ (2003).
  * Li et al. (2023) Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. 2023\.  Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models.  _arXiv preprint arXiv:2301.12597_ (2023).
  * Lu et al. (2023) Zeyu Lu, Di Huang, Lei Bai, Jingjing Qu, Chengyue Wu, Xihui Liu, and Wanli Ouyang. 2023.  Seeing is not always believing: Benchmarking Human and Model Perception of AI-Generated Images.  _arXiv preprint arXiv:2304.13023_ (2023).
  * Madry et al. (2017) Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017\.  Towards deep learning models resistant to adversarial attacks.  _arXiv preprint arXiv:1706.06083_ (2017).
  * Maiberg (2023) Emanuel Maiberg. 2023\.  AI Images Detectors Are Being Used to Discredit the Real Horrors of War.  404Media.
  * MaxonVFX (2024) MaxonVFX. 2024.  We extend our apologies to the community.  https://twitter.com/MaxonVFX/status/1748826148858208286.
  * Midjourney (2023) Midjourney. 2023\.  Midjourney.  https://www.midjourney.com/.
  * Nichol et al. (2022) Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. 2022\.  Hierarchical text-conditional image generation with clip latents.  _arXiv preprint arXiv:2204.06125_ (2022).
  * Northup (2023) Travis Northup. 2023\.  Wizards of the Coast Repeats Anti-AI Art Stance After Player’s Handbook Controversy.  IGN.com.
  * Ong (2023) Jie Yee Ong. 2023\.  Scooby-Doo: Daphne Voice Actor Fell Victim To $1,000 AI Art Scam.  The Chainsaw.
  * OpenAI (2022) OpenAI. 2022.  DALL·E 2.  https://openai.com/dall-e-2.
  * OpenAI (2023) OpenAI. 2023.  DALL·E 3.  https://openai.com/dall-e-3.
  * Optic (2023) Optic. 2023.  AI or Not.  https://www.aiornot.com.
  * Orland (2024) Kyle Orland. 2024\.  Magic: The Gathering Maker Admits it Used AI-generated Art Despite Standing Ban.  https://arstechnica.com/ai/2024/01/magic-the-gathering-maker-admits-it-used-ai-generated-art-despite-standing-ban/.
  * Page-Katz (2023) Susannah Page-Katz. 2023\.  Introducing Our AI Policy.  Kickstarter.com.
  * Podell et al. (2023) Dustin Podell et al. 2023\.  SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis.  _arXiv preprint arXiv:2307.01952_ (2023).
  * Radford et al. (2021) Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021\.  Learning transferable visual models from natural language supervision. In _Proc. of ICML_.
  * Ramesh et al. (2022) Aditya Ramesh et al. 2022\.  Hierarchical text-conditional image generation with clip latents.  _arXiv preprint arXiv:2204.06125_ (2022).
  * Ricker et al. (2023) Jonas Ricker, Simon Damm, Thorsten Holz, and Asja Fischer. 2023\.  Towards the Detection of Diffusion Model Deepfakes.  _arXiv preprint arXiv:2210.14571_ (2023).
  * Rombach et al. (2022) Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022\.  High-resolution image synthesis with latent diffusion models. In _Proc. of CVPR_. 10684–10695.
  * Roose (2022) Kevin Roose. 2022\.  An A.I.-Generated Picture Won an Art Prize. Artists Aren’t Happy.  https://www.nytimes.com/2022/09/02/technology/ai-artificial-intelligence-artists.html.
  * Sato (2023) Mia Sato. 2023.  How AI art killed an indie book cover contest.  The Verge.
  * Schuhmann et al. (2022) Christoph Schuhmann et al. 2022\.  Laion-5b: An open large-scale dataset for training next generation image-text models.  _arXiv preprint arXiv:2210.08402_ (2022).
  * Sha et al. (2023) Zeyang Sha, Zheng Li, Ning Yu, and Yang Zhang. 2023\.  DE-FAKE: Detection and Attribution of Fake Images Generated by Text-to-Image Generation Models.  _arXiv preprint arXiv:1804.00792_ (2023).
  * Shaffi (2023) Sarah Shaffi. 2023\.  Bloomsbury admits using AI-generated artwork for Sarah J Maas novel.  The Guardian.
  * Shan et al. (2023) Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y. Zhao. 2023\.  Glaze: Protecting artists from style mimicry by text-to-image models. In _Proc. of USENIX Security_.
  * Show” (2024) ”Eons Show”. 2024\.  Eons Show apologies for violating own AI policy.  Twitter.  https://x.com/EonsShow/status/1751327424556544451.
  * Shumailov et al. (2023) Ilia Shumailov et al. 2023\.  The Curse of Recursion: Training on Generated Data Makes Models Forget.  _arXiv preprint arxiv:2305.17493_ (2023).
  * Small (2023) Zachary Small. 2023\.  As Fight Over A.I. Artwork Unfolds, Judge Rejects Copyright Claim.  NY Times.
  * Song et al. (2023) Haixu Song, Shiyu Huang, Yinpeng Dong, and Wei-Wei Tu. 2023\.  Robustness and Generalizability of Deepfake Detection: A Study with Diffusion Models.  _arXiv preprint arXiv:2309.02218_ (2023).
  * Spring et al. (2016) Kenneth R. Spring, John C. Russ, Matthew J. Parry-Hill, and Michael W. Davidson. 2016.  JPEG Image Compression.  National High Magnetic Field Laboratory.
  * Stability AI (2022) Stability AI. 2022\.  Stable Diffusion Public Release.  https://stability.ai/blog/stable-diffusion-public-release.
  * StabilityAI (2022a) StabilityAI. 2022a.  Stable Diffusion v1-4 Model Card.  https://huggingface.co/CompVis/stable-diffusion-v1-4.
  * StabilityAI (2022b) StabilityAI. 2022b.  Stable Diffusion v1-5 Model Card.  https://huggingface.co/runwayml/stable-diffusion-v1-5.
  * Staff” (2023) ”Portal Staff”. 2023\.  League of Legends AI-Generated LATAM Anniversary Video Gets Taken Down.  ZLeague The Portal.
  * Steele (2023) Chandra Steele. 2023\.  How to Detect AI-Created Images.  https://www.pcmag.com/how-to/how-to-detect-ai-created-images.
  * Thompson and Hsu (2023) Stuart A. Thompson and Tiffany Hsu. 2023.  How Easy Is It to Fool A.I.-Detection Tools?  https://www.nytimes.com/interactive/2023/06/28/technology/ai-detection-midjourney-stable-diffusion-dalle.html.
  * Wang et al. (2020) Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A. Efros. 2020.  CNN-generated images are surprisingly easy to spot… for now.  _arXiv preprint arXiv:1912.11035_ (2020).
  * Wang et al. (2023b) Yabin Wang, Zhiwu Huang, and Xiaopeng Hong. 2023b.  Benchmarking Deepart Detection.  _arXiv preprint arXiv:2302.14475_ (2023).
  * Wang et al. (2023a) Zhendong Wang, Jianmin Bao, Wengang Zhou, Weilun Wang, Hezhen Hu, Hong Chen, and Houqiang Li. 2023a.  Scaling Language-Image Pre-training via Masking. In _Proc. of ICCV_.
  * Wen et al. (2023) Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. 2023.  Tree-Rings Watermarks: Invisible Fingerprints for Diffusion Images. In _Proc. of NeurIPS_.
  * Wilson (2024) Cam Wilson. 2024\.  AI is producing ‘fake’ Indigenous art trained on real artists’ work without permission.  Crickey.com.au.
  * Zhang et al. (2024) Lijun Zhang, Xiao Liu, Antoni Viros Martin, Cindy Xiong Bearfield, Yuriy Brun, and Hui Guan. 2024\.  Robust Image Watermarking using Stable Diffusion.  _arXiv preprint arXiv:2401.04247_ (2024).
  * Zhu et al. (2023) Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang. 2023\.  GenImage: A Million-Scale Benchmark for Detecting AI-Generated Image.  _arXiv preprint arXiv:2306.08571_ (2023).

## Appendix

Additional Information on Data Collection. Table 12 summarizes the number of
images curated as human artworks for each of the 7 art styles and the AI-
generated images per generation model. Table 13 lists the modifications made
to the extracted BLIP captions, which are then used to prompt individual AI
generators. And Figure 7 shows visual examples of the five types of
perturbations considered in our study.

Detection Results of DIRE Models. Table 14 shows the detection results using 6
DIRE checkpoints, using on our dataset of human artwork and AI-generated
images. We test each model with the same set of 630 unperturbed images: 280
human artworks and 350 AI-generated images.

Additional Results on Hive. Table 15 shows the distribution of images across
art style and generative model, which are “easy-to-detect” by Hive and
unaffected by all five perturbations.

Results on Unusual Images. Figure 6 plots, for both hybrid images and upscaled
human art, the distribution of the “raw” detection decision represented by the
5-point Likert score.

Figure 6. Distribution of detection decision represented by the 5-point Likert
rating on (a) hybrid images and (b) upscaled human artworks.

Real Artworks | AI-Generated Images
---|---
Human Artists | CIVITAI | DALL-E 3 | Firefly | MJv6 | SDXL
Anime | 40 | 10 | 10 | 10 | 10 | 10
Cartoon | 40 | 10 | 10 | 10 | 10 | 10
Fantasy | 40 | 10 | 10 | 10 | 10 | 10
Oil/Acrylic | 40 | 10 | 10 | 10 | 10 | 10
Photography | 40 | 10 | 10 | 10 | 10 | 10
Sketch | 40 | 10 | 10 | 10 | 10 | 10
Watercolor | 40 | 10 | 10 | 10 | 10 | 10
Total | 280 | 70 | 70 | 70 | 70 | 70
350

Table 12. Our dataset includes 280 real artworks and 350 AI-generated images,
covering 7 art styles and 5 AI generators. Each numerical value represents the
# of images. Figure 7. Samples of five different perturbations considered by
our study.

Modified Prompt for Each Style
---
Style |  | Modified Prompt:
---
added the phrase
Anime | ”anime”
Cartoon | a cartoon style image of”
Fantasy | ”a fantasy style image of”
Oil/Acrylic | ”an oil and acrylic painting of”
Photography | ”a photography of”
Sketch | ”a sketch drawing of”
Watercolor | ”a watercolor painting of”

Table 13. Phrases added to the BLIP caption extracted from human arts to
recover the misplaced art styles. These captions are then used to prompt AI
generators.

DIRE model | ACC(%)$\uparrow$ | FPR(%)$\downarrow$ | FNR(%)$\downarrow$
---|---|---|---
| Training
---
dataset
| Generation
---
model
ImageNet | ADM | 54.44 | 96.43 | 4.86
LSUN | PNDM | 54.76 | 100.00 | 1.43
LSUN | StyleGAN | 55.40 | 99.29 | 0.86
LSUN | ADM | 55.08 | 99.29 | 1.42
LSUN | iDDPM | 54.45 | 97.86 | 3.71
CelebA-HQ | SD-v2 | 51.59 | 25.36 | 66.86

Table 14. Performance of six DIRE checkpoint models on our dataset.

| CIVITAI | DALL-E 3 | Firefly | MJv6 | SDXL | Total
---|---|---|---|---|---|---
Anime | 4 | 4 | 9 | 2 | 6 | 25
Cartoon | 5 | 6 | 8 | 1 | 6 | 26
Fantasy | 10 | 4 | 5 | 0 | 6 | 25
Oil/Acrylic | 6 | 6 | 1 | 0 | 1 | 14
Photography | 1 | 3 | 0 | 0 | 2 | 6
Sketch | 2 | 1 | 1 | 2 | 3 | 9
Watercolor | 5 | 5 | 7 | 1 | 6 | 24
Total | 33 | 29 | 31 | 6 | 30 | 129

Table 15. The number of AI-generated images such that for all perturbations,
Hive is at least 99% confident the images are AI-generated. Each column is a
generative model, and each row is a style.